Source: http://cgi.www5b.biglobe.ne.jp/~tomo5-55/accp4_8/acc/acc.cgi?REDIRECT=https://nightofkhifes.za.com/qazwsx/auth/JJHFHKS/KDKKDSS/xxx@xxx.com |
SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering |
Source: http://cgi.www5b.biglobe.ne.jp/~tomo5-55/accp4_8/acc/acc.cgi?REDIRECT=https://nightofkhifes.za.com/qazwsx/auth/JJHFHKS/KDKKDSS/xxx@xxx.com |
Sample URL: PII: xxx@xxx.com |
Source: http://cgi.www5b.biglobe.ne.jp/~tomo5-55/accp4_8/acc/acc.cgi?REDIRECT=https://nightofkhifes.za.com/qazwsx/auth/JJHFHKS/KDKKDSS/xxx@xxx.com |
HTTP Parser: No favicon |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_BITS_4840_425143694 |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057 |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\keys.json |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\manifest.json |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\LICENSE |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\_metadata\ |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\_metadata\verified_contents.json |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\manifest.fingerprint |
Jump to behavior |
Source: unknown |
DNS traffic detected: queries for: clients2.google.com |
Source: unknown |
Network traffic detected: HTTP traffic on port 49734 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49770 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49727 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49728 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49770 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49728 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49727 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49734 |
Source: global traffic |
HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /~tomo5-55/accp4_8/acc/acc.cgi?REDIRECT=https://nightofkhifes.za.com/qazwsx/auth/JJHFHKS/KDKKDSS/xxx@xxx.com HTTP/1.1Host: cgi.www5b.biglobe.ne.jpConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cgi.www5b.biglobe.ne.jpConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://cgi.www5b.biglobe.ne.jp/~tomo5-55/accp4_8/acc/acc.cgi?REDIRECT=https://nightofkhifes.za.com/qazwsx/auth/JJHFHKS/KDKKDSS/xxx@xxx.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9 |
Source: global traffic |
HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Fri, 18 Aug 2023 01:02:53 GMTContent-Type: text/htmlContent-Length: 203Connection: keep-aliveLast-Modified: Fri, 23 Dec 2022 01:08:07 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html> |
Source: chromecache_195.1.dr |
String found in binary or memory: https://nightofkhifes.za.com/qazwsx/auth/JJHFHKS/KDKKDSS/xxx |
Source: keys.json.0.dr |
String found in binary or memory: https://polyset.xyz |
Source: keys.json.0.dr |
String found in binary or memory: https://pst-issuer.hcaptcha.com |
Source: keys.json.0.dr |
String found in binary or memory: https://trusttoken.dev |
Source: unknown |
HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB; 1P_JAR=2023-08-10-10 |
Source: classification engine |
Classification label: mal48.win@32/7@47/6 |
Source: unknown |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank |
|
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1884,i,5122482533045353137,5169719114078313842,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
|
Source: unknown |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://cgi.www5b.biglobe.ne.jp/~tomo5-55/accp4_8/acc/acc.cgi?REDIRECT=https://nightofkhifes.za.com/qazwsx/auth/JJHFHKS/KDKKDSS/xxx@xxx.com |
|
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1884,i,5122482533045353137,5169719114078313842,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Process created: unknown unknown |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
File created: C:\Program Files\chrome_BITS_4840_425143694 |
Jump to behavior |
Source: Window Recorder |
Window detected: More than 3 window changes detected |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_BITS_4840_425143694 |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057 |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\keys.json |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\manifest.json |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\LICENSE |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\_metadata\ |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\_metadata\verified_contents.json |
Jump to behavior |
Source: C:\Program Files\Google\Chrome\Application\chrome.exe |
Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4840_681014057\manifest.fingerprint |
Jump to behavior |