Windows Analysis Report
https://delightful-glacier-0a63b1710.5.azurestaticapps.net/?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426

Overview

General Information

Sample URL:	https://delightful-glacier-0a63b1710.5.azurestaticapps.net/?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426
Analysis ID:	1427692
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://delightful-glacier-0a63b1710.5.azurestaticapps.net/?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426

SlashNext: detection malicious, Label: Scareware type: Phishing & Social Engineering

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.50.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.50.19
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.245.97
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.245.97
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426 HTTP/1.1Host: delightful-glacier-0a63b1710.5.azurestaticapps.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: delightful-glacier-0a63b1710.5.azurestaticapps.net

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/htmlDate: Wed, 17 Apr 2024 22:38:03 GMTTransfer-Encoding: chunked

Source: chromecache_54.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/bootstrap/5.2.3/bootstrap.min.js
Source: chromecache_54.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/bootstrap/5.2.3/css/bootstrap.min.css
Source: chromecache_54.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jquery/jquery-3.7.1.min.js
Source: chromecache_54.2.dr	String found in binary or memory: https://appservice.azureedge.net/css/static-apps/v3/main.css
Source: chromecache_54.2.dr	String found in binary or memory: https://appservice.azureedge.net/images/static-apps/v3/favicon.svg
Source: chromecache_54.2.dr	String found in binary or memory: https://appservice.azureedge.net/images/static-apps/v3/microsoft_azure_logo.svg
Source: chromecache_54.2.dr	String found in binary or memory: https://appservice.azureedge.net/images/static-apps/v3/staticapps.svg
Source: chromecache_54.2.dr	String found in binary or memory: https://appservice.azureedge.net/scripts/static-apps/v3/loc.min.js
Source: chromecache_52.2.dr, chromecache_46.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_52.2.dr, chromecache_46.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_46.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@16/21@6/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2224,i,8484140261916216697,7846924340831957304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://delightful-glacier-0a63b1710.5.azurestaticapps.net/?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2224,i,8484140261916216697,7846924340831957304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.138.99	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.22.16.164	waws-prod-bn1-4358465d.sip.p.azurewebsites.windows.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4

Contacted Domains

Name	IP	Active
waws-prod-bn1-4358465d.sip.p.azurewebsites.windows.net	20.22.16.164	true
www.google.com	74.125.138.99	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true
delightful-glacier-0a63b1710.5.azurestaticapps.net	unknown	unknown
ajax.aspnetcdn.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://delightful-glacier-0a63b1710.5.azurestaticapps.net/?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426	true		unknown

ID:	1427692
Product:	CloudBasic
Start time:	00:37:08
Start date:	18.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 44	SVG Scalable Vector Graphics image	B1EE4C89DD83CECE9412A3C847C2F815	02DB4BC607FF302C1274CBA13CF31F8098681ACA	B4B809961668BD61715C146DFCF59B3D9EA9A1C6CC8091C29FA547302CDDF3C1
Chrome Cache Entry: 45	ASCII text, with very long lines (65447)	2C872DBE60F4BA70FB85356113D8B35E	EE48592D1FFF952FCF06CE0B666ED4785493AFDC	FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
Chrome Cache Entry: 46	ASCII text, with very long lines (60125)	B0794583EC020A7852F0FC04D5CEFC52	847DFF899B5BCF8EE434E389E2A910BA1DBAD76F	9BCD4D0F29DC6556EBEEFF44EAA0965F0C7F7308EE58394708CCE2F698CCA1B0
Chrome Cache Entry: 47	SVG Scalable Vector Graphics image	1A813EE7E1120C4D7B3E8EBD29AAF72F	5B3F94C56FD08BD6F582B2295D1996D484A66DD5	AF633C8781D0E41FB1787E2709FF7926A0519C80A80BDD057021E00E1B48DDA2
Chrome Cache Entry: 48	SVG Scalable Vector Graphics image	909D8AC61BECBB0F646873BA6DED610E	30FA898D5052820BE3747E96641B9AE6B409BE75	30EFD61236D5F5FE2B02866F3B822CE9224D2315814FAC05DA9B7BFC76CA2E3F
Chrome Cache Entry: 49	ASCII text, with CRLF line terminators	FBBC82923FF6881236B01520BAA9F0EF	20DE932A247D76E8865BCC2411E38DB4D9807C4A	BD6300F28F9701DDC7283D2E6629020FC7969E5064E4258A894FDD2EF6DA666F
Chrome Cache Entry: 50	SVG Scalable Vector Graphics image	1A813EE7E1120C4D7B3E8EBD29AAF72F	5B3F94C56FD08BD6F582B2295D1996D484A66DD5	AF633C8781D0E41FB1787E2709FF7926A0519C80A80BDD057021E00E1B48DDA2
Chrome Cache Entry: 51	ASCII text, with CRLF line terminators	8DC1B0215D4842AAE9BB811E9B655919	852DDB564BDFDF837E32D672B073734E15593283	666DD97A683171808B9AAAF4A1EF11C97865DF5046172FED704F70C78E940830
Chrome Cache Entry: 52	Unicode text, UTF-8 text, with very long lines (65305)	3F30C2C47D7D23C7A994DB0C862D45A5	7791DD1F3173A0D62CC39C21D2AD71FC8DAD0E72	C0BCF7898FDC3B87BABCA678CD19A8E3EF570E931C80A3AFBFFCC453738C951A
Chrome Cache Entry: 53	SVG Scalable Vector Graphics image	B1EE4C89DD83CECE9412A3C847C2F815	02DB4BC607FF302C1274CBA13CF31F8098681ACA	B4B809961668BD61715C146DFCF59B3D9EA9A1C6CC8091C29FA547302CDDF3C1
Chrome Cache Entry: 54	HTML document, Unicode text, UTF-8 text, with CRLF line terminators	8B6E5A69AAFD321F4CFF4ED84BB3BDE1	B6E7634A826B088DC49DBD8F61B0121327846271	0A76274E99E285C9D7E18D094E71EA6FCA1B0274E30C28492A24218E53C61CB3
Chrome Cache Entry: 55	SVG Scalable Vector Graphics image	909D8AC61BECBB0F646873BA6DED610E	30FA898D5052820BE3747E96641B9AE6B409BE75	30EFD61236D5F5FE2B02866F3B822CE9224D2315814FAC05DA9B7BFC76CA2E3F

Windows Analysis Report
https://delightful-glacier-0a63b1710.5.azurestaticapps.net/?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://delightful-glacier-0a63b1710.5.azurestaticapps.net/?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://delightful-glacier-0a63b1710.5.azurestaticapps.net/?bezp=5565454&clickid=97a06722cf29085a7ee6b1e853b28f1e&phone=+1-866-993-6426