Windows Analysis Report
https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVc

Overview

General Information

Sample URL:	https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZ
Analysis ID:	1427115
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML title does not match URL

Classification

Signatures

Phishing

Phishing site detected (based on image similarity)

Source: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

HTML body contains low number of good links

HTTP Parser: Number of links: 0

HTML title does not match URL

HTTP Parser: Title: does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09 HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/Sign_In_files/style.css HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/login.js HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/jquery-3.5.1.min.js HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/bootstrap.min.js HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.prizeably.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.prizeably.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.prizeably.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: www.prizeably.es

Source: chromecache_48.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_48.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_48.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@16/23@4/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2328,i,6434737573605265882,10283046775488067918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2328,i,6434737573605265882,10283046775488067918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.215.147	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.70	part-0042.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4

Contacted Domains

Name	IP	Active
part-0013.t-0009.t-msedge.net	13.107.246.41	true
www.google.com	172.217.215.147	true
part-0012.t-0009.t-msedge.net	13.107.246.40	true
part-0042.t-0009.t-msedge.net	13.107.246.70	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
www.prizeably.es	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.prizeably.es/Content/Sign_In_files/style.css	false	unknown
https://www.prizeably.es/favicon.ico	false	unknown
https://www.prizeably.es/Content/jquery-3.5.1.min.js	false	unknown
https://www.prizeably.es/Content/login.js	false	unknown
https://www.prizeably.es/Content/bootstrap.min.js	false	unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 48	ASCII text, with very long lines (50758), with CRLF line terminators	E47A9D976663A4CE4DB5961AF909EB58	12CA7264086B9E543605395947C6671EDDE9AC80	4F3FAEEC469294B610F6CA82AA1CC2B3368FD56611B31C551C2EE224FEADB411
Chrome Cache Entry: 49	Unicode text, UTF-8 text, with CRLF line terminators	BAD3E4D73AB8638EF18D6B46780111A9	4C253CF88BE490DD7E435BC3ABFBBD18D2011227	F116760BD4B44C1A29B36DD4D59729BAD9091A9B0E89C2B470BFF0086982A822
Chrome Cache Entry: 50	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 51	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 52	HTML document, ASCII text, with very long lines (64961), with CRLF line terminators	BA019172D690669F6D92ABA85BE1A66C	4144036104EF49AD7087BB5ED46C3571AD9FE1DF	44B83D90140D64CA74023355F2284DEABA49C0A8329CB94FDE4C91CA1E4F53A9
Chrome Cache Entry: 53	HTML document, ASCII text, with CRLF line terminators	87306133C167AE6AF4FCBC9FE0876B2B	4612A396F54161FBEFB3A375BD8B640A302D03E8	C14468CDC2213365958A15B100E91D5B1722EFED31F0EB898D838EB7114316FE
Chrome Cache Entry: 54	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	1E3427A62E79ED24BDFC6FFA1DDC2DC2	C2FBC41FCADF48518192F5CD1C968FB05FA44617	9029D5647ED4D5172C6876489B36E572A3F9320E93A2E84BABE158C011040FDB
Chrome Cache Entry: 55	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 56	ASCII text, with no line terminators	3D2521FFBAB3E52763AF5439D945B965	EC6A09A9174EFFAA5ED0DBB2360490ECB7414AEF	918EA5B7AA4FF7D34A5724FA49F2D8080A7F6F93289A90B7C80A1365F10BF1BE
Chrome Cache Entry: 57	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592	4761405717E938D7E7400BB15715DB1E	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
Chrome Cache Entry: 58	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 59	ASCII text, with very long lines (65450), with CRLF line terminators	B61AA6E2D68D21B3546B5B418BF0E9C3	9C1398F0DE4C869DACB1C9AB1A8CC327F5421FF7	F36844906AD2309877AAE3121B87FB15B9E09803CB4C333ADC7E1E35AC92E14B
Chrome Cache Entry: 60	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592	4761405717E938D7E7400BB15715DB1E	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF

Phishing

Phishing site detected (based on image similarity)

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

HTML body contains low number of good links

HTTP Parser: Number of links: 0

HTML title does not match URL

HTTP Parser: Title: does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09 HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/Sign_In_files/style.css HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/login.js HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/jquery-3.5.1.min.js HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/bootstrap.min.js HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.prizeably.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.prizeably.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.prizeably.es/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.prizeably.esConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: www.prizeably.es

Source: chromecache_48.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_48.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_48.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49747 version: TLS 1.2

Source: classification engine

Classification label: mal48.phis.win@16/23@4/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2328,i,6434737573605265882,10283046775488067918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.prizeably.es/nam/e5a06f4a-1ec4-4d01-8f73-e7dd15f26134/546610a9-fe5f-4a73-a654-34b70f643dcc/87f066f9-a9e4-4291-ada2-9ebe227c3990/login?id=eCtVUWF0N2xJcytIOUNIeSsxYktIRy9FRTcxd1VvczA4ejVXdkZsOUlNbTB2bVl3V1JmK3NxRm1iZEkzNmFzb1Z0aStWaFNjV1hrUGQrZ29Ua0VWeDlQWUkyRURtS1FLT3dPRWptcGJ6bWVlZVFWVVcwUDkxVlRML3NHWHJkcSt1bUhQdWd0RTV0L0JhSEh3UFFIb1FnU1JhY0lGNzZsVW9DeU1BTmNrRzlheVJ6Y3c4cDhicmVJUmxoZ1ZJek5xemsyY0w2MERPdGIzeXdEaXdDWHU3aTBkdlRGM0d1U1VtZERRTWMyaDdiTFFrWHdySzk2eUVSWkJJUnBDVGZjSy8wYWZPWmw3OUZDYmh6WkRhNkM1QXdZcGZucSszRzl3VWU5Mm1WY3lBeEVlclk1V3pKQ1RHeU9rWHlFWmVZOU1OSGhEaXF1QXpCNGpZaHFpdFAwUmlBSnZXUWpuUGU0TS9wZURmYXloTHMyalpPSHpkZWxibm9jWG8ycHQxSWhjYVlVZzZ4dloxTUxZM2FnTzNCbkVmZz09"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2328,i,6434737573605265882,10283046775488067918,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1427115
Product:	CloudBasic
Start time:	02:12:18
Start date:	17.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs