Edit tour

Windows Analysis Report
http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js

Overview

General Information

Sample URL:	http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js
Analysis ID:	1520641
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1964,i,7520023127458122347,12437867996372691238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.21.6Date: Fri, 27 Sep 2024 15:42:16 GMTContent-Type: application/javascriptContent-Length: 0Connection: closeP3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"Access-Control-Allow-Origin: *Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UAHost: bleachinjectionuncommon.com

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49716 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@18/6@8/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1964,i,7520023127458122347,12437867996372691238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1964,i,7520023127458122347,12437867996372691238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
bleachinjectionuncommon.com	172.240.108.76	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.240.108.76	bleachinjectionuncommon.com	United States	7979	SERVERS-COMUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520641
Start date and time:	2024-09-27 17:41:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@18/6@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195, 142.250.181.238, 108.177.15.84, 34.104.35.123, 13.85.23.86, 199.232.210.172, 192.229.221.95, 13.85.23.206, 20.242.39.171, 142.250.74.195, 2.16.100.168, 88.221.110.91
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 14:42:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978674454708631
Encrypted:	false
SSDEEP:	48:8j0dvTH3sHZ0idAKZdA1oehwiZUklqeh0y+3:8jITmDry
MD5:	1582EEFBC8FFDE06AE1C3B283F83C364
SHA1:	601F46B276FB80C2A807C4C79E36BEFD0577233B
SHA-256:	B8FE167041E25AC38E7C51A3C4CDF257A4AA16338DC02AF1691D8CD6FD64391D
SHA-512:	62AB857C7CDA0AA6E3261207D858443E462931F847CD624B37A743A0EE724D39455815776F7C66735E7ACB8C46F5F900B15F16C3C68D7FA45AA6A57B5F1842C7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....M.;.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I;YG}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;YG}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;YG}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;YG}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;YH}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?B.V.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 14:42:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994544073887236
Encrypted:	false
SSDEEP:	48:8S0dvTH3sHZ0idAKZdA1leh/iZUkAQkqehby+2:8SITmx9QKy
MD5:	DDFA4D95BD50E342B0C7140E3E274B4B
SHA1:	85132458CD31B9F74514AE6DB3FAEBBBD89C33BB
SHA-256:	DA9D47A931C6F72E48CA7DCE33D94421B89280FBB66DA48E0FC80E4FDFD70E0C
SHA-512:	7820E714043D3AA1DAEAE6D425559D7CF29AE3BA00DCFE81A85C177E21E6825DD0FAEFAF6B76F48E383444EB2B54F4F529B1855CC2A41FA7ADA8783684B13FA6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I;YG}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;YG}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;YG}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;YG}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;YH}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?B.V.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007455333414247
Encrypted:	false
SSDEEP:	48:8+0dvTH3bHZ0idAKZdA14t5eh7sFiZUkmgqeh7sBy+BX:8+IT1Rn/y
MD5:	44C974E5C7BF58F29CD09843879AA4B3
SHA1:	2F39055362AF04AD2B072DEFE04FABC79616AC92
SHA-256:	5AEAE9B7F3F6D850C2584E8D44C457B69D7EFF3DB9F92DB7140738E22AF9692C
SHA-512:	DD805F5A4C956677ED2F59DDAE50EEC1AAEC421280F278F94796380C159F0C019155C4618261137302811510EA3775D486F7E543A2091C2F08AD95CA8A4FB229
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I;YG}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;YG}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;YG}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;YG}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?B.V.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 14:42:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9944371216010794
Encrypted:	false
SSDEEP:	48:8S0dvTH3sHZ0idAKZdA16ehDiZUkwqehny+R:8SITmCpy
MD5:	CFF09A1582E16DEC30FD90E7DCB9110E
SHA1:	38744014F4369E4C1D7DBF9EF21F561C286807C9
SHA-256:	4E5043EB038DEF5D241A260AC4DFF1A002510E4C7E7D0691BE94C4835BB19755
SHA-512:	6037CCE3D1DD219D1C183CB882471985484D60C7C96297123DCCC564BB3578EBF8865CB1FC7745C779DEF277C025C42E7E563A677D1EED538A447CDF18B95EAD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Cz'.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I;YG}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;YG}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;YG}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;YG}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;YH}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?B.V.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 14:42:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9844736571389627
Encrypted:	false
SSDEEP:	48:8q0dvTH3sHZ0idAKZdA1UehBiZUk1W1qehVy+C:8qITmy91y
MD5:	E0B98FC990ED4D9656F617C49C4EAB60
SHA1:	47378A740A5ACD56127EB8A96066DC381F73F2AC
SHA-256:	8F2D0FA8064CDC382689F264D8F2F3ECF4D1D2B513592C3A5881E7D997FC91E8
SHA-512:	727F94619489BF96073BC4465329ADC4CB59D6A6529ED0C40482485CADDBB92DDDE1E3EBB8B2EAC0390F5A243EB08DC4B05E8BED4F9F681D23D4C9780FDCDAE3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......4.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I;YG}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;YG}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;YG}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;YG}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;YH}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?B.V.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Sep 27 14:42:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9923969212064327
Encrypted:	false
SSDEEP:	48:8L0dvTH3sHZ0idAKZdA1duTrehOuTbbiZUk5OjqehOuTb/y+yT+:8LITmzTYTbxWOvTb/y7T
MD5:	2614A939C241F51709CBFBCCC09ACD06
SHA1:	BE0AD787D730C48B7593EA211036AB0F19CD1F16
SHA-256:	4A9EE1F117BF28050754710EFBE7471993AE0033BE1BD149010B695960B209E8
SHA-512:	B66F3B4ACD5BBA29C3B595CBC18CCD6C99BC25370AA7E636B7815CB77819D8CFCE2E2E1E8EF64ABF2E302310EE51DCAFEE4BA1382BBA64060F31A931B8E4EA2D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....u.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I;YG}....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;YG}....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;YG}....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;YG}..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;YH}...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........?B.V.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:42:06.795151949 CEST	49676	443	192.168.2.8	52.182.143.211
Sep 27, 2024 17:42:07.092021942 CEST	49673	443	192.168.2.8	23.206.229.226
Sep 27, 2024 17:42:07.404571056 CEST	49672	443	192.168.2.8	23.206.229.226
Sep 27, 2024 17:42:07.982770920 CEST	49671	443	192.168.2.8	204.79.197.203
Sep 27, 2024 17:42:08.373230934 CEST	49677	80	192.168.2.8	192.229.211.108
Sep 27, 2024 17:42:16.010323048 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.010351896 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.010809898 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.010809898 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.010838985 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.048022032 CEST	49710	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.048207045 CEST	49711	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.052831888 CEST	80	49710	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.052911997 CEST	49710	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.052937031 CEST	80	49711	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.052993059 CEST	49711	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.454406977 CEST	49676	443	192.168.2.8	52.182.143.211
Sep 27, 2024 17:42:16.604916096 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.605433941 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.605448961 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.606491089 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.607144117 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.607868910 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.607868910 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.607877016 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.607933998 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.677673101 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.677686930 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.693160057 CEST	49673	443	192.168.2.8	23.206.229.226
Sep 27, 2024 17:42:16.720047951 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:16.720166922 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.721014977 CEST	49709	443	192.168.2.8	172.240.108.76
Sep 27, 2024 17:42:16.721029043 CEST	443	49709	172.240.108.76	192.168.2.8
Sep 27, 2024 17:42:17.008527994 CEST	49672	443	192.168.2.8	23.206.229.226
Sep 27, 2024 17:42:18.797095060 CEST	443	49703	23.206.229.226	192.168.2.8
Sep 27, 2024 17:42:18.797266960 CEST	49703	443	192.168.2.8	23.206.229.226
Sep 27, 2024 17:42:19.006063938 CEST	49677	80	192.168.2.8	192.229.211.108
Sep 27, 2024 17:42:19.163301945 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:19.163363934 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:19.163487911 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:19.163707018 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:19.163722038 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:19.817797899 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:19.820424080 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:19.820445061 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:19.821505070 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:19.821561098 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:19.835668087 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:19.835778952 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:19.880973101 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:19.880995035 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:19.907176971 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:19.907234907 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:19.907335043 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:19.912931919 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:19.912961006 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:19.927822113 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:20.788043976 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:20.788130045 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:20.796896935 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:20.796910048 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:20.797142029 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:20.843734026 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:20.899971962 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:20.947403908 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:21.154042006 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:21.154222965 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:21.154354095 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:21.154397011 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:21.154413939 CEST	49715	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:21.154422998 CEST	443	49715	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:21.203659058 CEST	49716	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:21.203762054 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:21.203849077 CEST	49716	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:21.204370022 CEST	49716	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:21.204406977 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:22.105210066 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:22.105318069 CEST	49716	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:22.108839989 CEST	49716	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:22.108851910 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:22.109195948 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:22.112597942 CEST	49716	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:22.159415007 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:22.405352116 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:22.405550957 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:22.405764103 CEST	49716	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:22.406404972 CEST	49716	443	192.168.2.8	184.28.90.27
Sep 27, 2024 17:42:22.406425953 CEST	443	49716	184.28.90.27	192.168.2.8
Sep 27, 2024 17:42:29.732851982 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:29.732920885 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:42:29.732975960 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:31.000020981 CEST	49714	443	192.168.2.8	216.58.206.68
Sep 27, 2024 17:42:31.000047922 CEST	443	49714	216.58.206.68	192.168.2.8
Sep 27, 2024 17:43:01.068267107 CEST	49710	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:43:01.068283081 CEST	49711	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:43:01.073173046 CEST	80	49710	172.240.108.76	192.168.2.8
Sep 27, 2024 17:43:01.073229074 CEST	80	49711	172.240.108.76	192.168.2.8
Sep 27, 2024 17:43:16.428642988 CEST	80	49711	172.240.108.76	192.168.2.8
Sep 27, 2024 17:43:16.428703070 CEST	49711	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:43:16.452084064 CEST	80	49710	172.240.108.76	192.168.2.8
Sep 27, 2024 17:43:16.452158928 CEST	49710	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:43:17.003947973 CEST	49710	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:43:17.004020929 CEST	49711	80	192.168.2.8	172.240.108.76
Sep 27, 2024 17:43:17.008913040 CEST	80	49710	172.240.108.76	192.168.2.8
Sep 27, 2024 17:43:17.008958101 CEST	80	49711	172.240.108.76	192.168.2.8
Sep 27, 2024 17:43:19.218632936 CEST	49724	443	192.168.2.8	142.250.186.132
Sep 27, 2024 17:43:19.218709946 CEST	443	49724	142.250.186.132	192.168.2.8
Sep 27, 2024 17:43:19.218864918 CEST	49724	443	192.168.2.8	142.250.186.132
Sep 27, 2024 17:43:19.219090939 CEST	49724	443	192.168.2.8	142.250.186.132
Sep 27, 2024 17:43:19.219125986 CEST	443	49724	142.250.186.132	192.168.2.8
Sep 27, 2024 17:43:19.856239080 CEST	443	49724	142.250.186.132	192.168.2.8
Sep 27, 2024 17:43:19.856565952 CEST	49724	443	192.168.2.8	142.250.186.132
Sep 27, 2024 17:43:19.856590033 CEST	443	49724	142.250.186.132	192.168.2.8
Sep 27, 2024 17:43:19.856878042 CEST	443	49724	142.250.186.132	192.168.2.8
Sep 27, 2024 17:43:19.857192993 CEST	49724	443	192.168.2.8	142.250.186.132
Sep 27, 2024 17:43:19.857245922 CEST	443	49724	142.250.186.132	192.168.2.8
Sep 27, 2024 17:43:19.911614895 CEST	49724	443	192.168.2.8	142.250.186.132
Sep 27, 2024 17:43:29.777002096 CEST	443	49724	142.250.186.132	192.168.2.8
Sep 27, 2024 17:43:29.777091026 CEST	443	49724	142.250.186.132	192.168.2.8
Sep 27, 2024 17:43:29.777314901 CEST	49724	443	192.168.2.8	142.250.186.132
Sep 27, 2024 17:43:30.992800951 CEST	49724	443	192.168.2.8	142.250.186.132
Sep 27, 2024 17:43:30.992856026 CEST	443	49724	142.250.186.132	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:42:14.804436922 CEST	53	64015	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:14.827799082 CEST	53	56648	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:15.968039989 CEST	55430	53	192.168.2.8	1.1.1.1
Sep 27, 2024 17:42:15.968308926 CEST	55649	53	192.168.2.8	1.1.1.1
Sep 27, 2024 17:42:15.979136944 CEST	51478	53	192.168.2.8	1.1.1.1
Sep 27, 2024 17:42:15.979357958 CEST	54640	53	192.168.2.8	1.1.1.1
Sep 27, 2024 17:42:16.001421928 CEST	53	55649	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:16.002482891 CEST	53	51478	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:16.013936043 CEST	53	54640	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:16.047166109 CEST	53	55430	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:16.050472021 CEST	53	54779	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:19.153067112 CEST	61169	53	192.168.2.8	1.1.1.1
Sep 27, 2024 17:42:19.153067112 CEST	59230	53	192.168.2.8	1.1.1.1
Sep 27, 2024 17:42:19.160120010 CEST	53	61169	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:19.160384893 CEST	53	59230	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:33.060525894 CEST	53	59670	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:51.938342094 CEST	53	60920	1.1.1.1	192.168.2.8
Sep 27, 2024 17:42:57.009963036 CEST	138	138	192.168.2.8	192.168.2.255
Sep 27, 2024 17:43:14.224836111 CEST	53	54861	1.1.1.1	192.168.2.8
Sep 27, 2024 17:43:14.554569006 CEST	53	64879	1.1.1.1	192.168.2.8
Sep 27, 2024 17:43:19.209712982 CEST	55932	53	192.168.2.8	1.1.1.1
Sep 27, 2024 17:43:19.210099936 CEST	50230	53	192.168.2.8	1.1.1.1
Sep 27, 2024 17:43:19.216969967 CEST	53	55932	1.1.1.1	192.168.2.8
Sep 27, 2024 17:43:19.217901945 CEST	53	50230	1.1.1.1	192.168.2.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 27, 2024 17:42:16.014467955 CEST	192.168.2.8	1.1.1.1	c239	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 17:42:15.968039989 CEST	192.168.2.8	1.1.1.1	0x3aa3	Standard query (0)	bleachinjectionuncommon.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:15.968308926 CEST	192.168.2.8	1.1.1.1	0xf44f	Standard query (0)	bleachinjectionuncommon.com	65	IN (0x0001)	false
Sep 27, 2024 17:42:15.979136944 CEST	192.168.2.8	1.1.1.1	0xaafd	Standard query (0)	bleachinjectionuncommon.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:15.979357958 CEST	192.168.2.8	1.1.1.1	0x6039	Standard query (0)	bleachinjectionuncommon.com	65	IN (0x0001)	false
Sep 27, 2024 17:42:19.153067112 CEST	192.168.2.8	1.1.1.1	0xe3e6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:19.153067112 CEST	192.168.2.8	1.1.1.1	0x1b08	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 17:43:19.209712982 CEST	192.168.2.8	1.1.1.1	0xb2f5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:43:19.210099936 CEST	192.168.2.8	1.1.1.1	0xc2b6	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		172.240.108.76	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		172.240.253.132	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		192.243.61.227	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		192.243.59.13	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		172.240.108.84	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		192.243.59.20	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		192.243.59.12	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		172.240.127.234	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		192.243.61.225	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.002482891 CEST	1.1.1.1	192.168.2.8	0xaafd	No error (0)	bleachinjectionuncommon.com		172.240.108.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		172.240.108.76	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		172.240.253.132	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		192.243.61.227	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		192.243.59.13	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		172.240.108.84	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		192.243.59.20	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		192.243.59.12	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		172.240.127.234	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		192.243.61.225	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:16.047166109 CEST	1.1.1.1	192.168.2.8	0x3aa3	No error (0)	bleachinjectionuncommon.com		172.240.108.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:19.160120010 CEST	1.1.1.1	192.168.2.8	0xe3e6	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:19.160384893 CEST	1.1.1.1	192.168.2.8	0x1b08	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 27, 2024 17:42:27.894040108 CEST	1.1.1.1	192.168.2.8	0xd419	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:27.894040108 CEST	1.1.1.1	192.168.2.8	0xd419	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:28.736450911 CEST	1.1.1.1	192.168.2.8	0x52cf	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:42:28.736450911 CEST	1.1.1.1	192.168.2.8	0x52cf	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:41.850348949 CEST	1.1.1.1	192.168.2.8	0x6347	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:42:41.850348949 CEST	1.1.1.1	192.168.2.8	0x6347	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:43:07.030673981 CEST	1.1.1.1	192.168.2.8	0xde15	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:43:07.030673981 CEST	1.1.1.1	192.168.2.8	0xde15	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:43:19.216969967 CEST	1.1.1.1	192.168.2.8	0xb2f5	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:43:19.217901945 CEST	1.1.1.1	192.168.2.8	0xc2b6	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 27, 2024 17:43:27.451508999 CEST	1.1.1.1	192.168.2.8	0x7dbc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:43:27.451508999 CEST	1.1.1.1	192.168.2.8	0x7dbc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bleachinjectionuncommon.com

fs.microsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	172.240.108.76	80	564	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:01.068267107 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	172.240.108.76	80	564	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:01.068283081 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	172.240.108.76	443	564	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:16 UTC	714	OUT	GET /10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js HTTP/1.1 Host: bleachinjectionuncommon.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 15:42:16 UTC	575	IN	HTTP/1.1 403 Forbidden Server: nginx/1.21.6 Date: Fri, 27 Sep 2024 15:42:16 GMT Content-Type: application/javascript Content-Length: 0 Connection: close P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Access-Control-Allow-Origin: * Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA Host: bleachinjectionuncommon.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49715	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 15:42:21 UTC	494	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=25966 Date: Fri, 27 Sep 2024 15:42:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49716	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 15:42:22 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25934 Date: Fri, 27 Sep 2024 15:42:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-27 15:42:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Target ID:	0
Start time:	11:42:10
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:42:13
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1964,i,7520023127458122347,12437867996372691238,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:42:14
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	HTTP traffic detected: GET /10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js HTTP/1.1Host: bleachinjectionuncommon.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bleachinjectionuncommon.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3996, Parent PID: 2648

General

Chronological Activities

Analysis Process: chrome.exePID: 564, Parent PID: 3996

General

Chronological Activities

Analysis Process: chrome.exePID: 5072, Parent PID: 2648

General

Windows Analysis Report
http://bleachinjectionuncommon.com/10/01/c8/1001c8ae384bf3571ef4f7a804d4d9c9.js