Windows Analysis Report
https://mitchells-place.pages.dev/

Overview

General Information

Sample URL: https://mitchells-place.pages.dev/
Analysis ID: 1428992
Infos:

Detection

HTMLPhisher
Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected HtmlPhish10
Yara detected HtmlPhish7
Phishing site detected (based on image similarity)
Phishing site or detected (based on various text indicators)
HTML body contains low number of good links
HTML body contains password input but no form action
HTML title does not match URL

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://mitchells-place.pages.dev/ SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing
barindex
Yara detected HtmlPhish10
Source: Yara match File source: 0.0.pages.csv, type: HTML
Source: Yara match File source: dropped/chromecache_82, type: DROPPED
Source: Yara match File source: dropped/chromecache_63, type: DROPPED
Source: Yara match File source: dropped/chromecache_64, type: DROPPED
Yara detected HtmlPhish7
Source: Yara match File source: 0.0.pages.csv, type: HTML
Source: Yara match File source: dropped/chromecache_82, type: DROPPED
Source: Yara match File source: dropped/chromecache_63, type: DROPPED
Source: Yara match File source: dropped/chromecache_64, type: DROPPED
Phishing site detected (based on image similarity)
Source: https://mitchells-place.pages.dev/ Matcher: Found strong image similarity, combo hit
Phishing site or detected (based on various text indicators)
Source: Chrome DOM: 0.0 OCR Text: Adobe Document Cloud Because you are accessing sensitive info, you need to verify your email and password. Sign in with Gmail Sign in with Outlook Sign in with AOI Sign in with Office365 Sign in with Yahoo! o Sign in with Other Mail Go to your all file anpvhere on any device, and share them with anyone. One Drive your shared document in one cloud. OneDrive 2024
HTML body contains low number of good links
Source: https://mitchells-place.pages.dev/ HTTP Parser: Number of links: 0
HTML body contains password input but no form action
Source: https://mitchells-place.pages.dev/ HTTP Parser: <input type="password" .../> found but no <form action="...
HTML title does not match URL
Source: https://mitchells-place.pages.dev/ HTTP Parser: Title: Share Point Online does not match URL
Source: https://mitchells-place.pages.dev/ HTTP Parser: <input type="password" .../> found
Source: https://mitchells-place.pages.dev/ HTTP Parser: No favicon
Source: https://mitchells-place.pages.dev/ HTTP Parser: No <meta name="author".. found
Source: https://mitchells-place.pages.dev/ HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: mitchells-place.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: mitchells-place.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mitchells-place.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mitchells-place.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mitchells-place.pages.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://mitchells-place.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mitchells-place.pages.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mitchells-place.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mitchells-place.pages.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mitchells-place.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: mitchells-place.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mitchells-place.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Range: bytes=60954-60954If-Range: "6fef376afd8cbdd6c87cb7e9f1b0dca6"
Source: global traffic HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mitchells-place.pages.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mitchells-place.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mitchells-place.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mitchells-place.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mitchells-place.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: unknown DNS traffic detected: queries for: mitchells-place.pages.dev
Source: unknown HTTP traffic detected: POST /report/v4?s=g1EjkhBuLtN6gREKYIZUG9bm%2FkoSM6%2BpcHbMjjpKTaSYpjMTcEIm42rsqFbpSuu%2BcD8z5Uyh%2Bx1WkU81MnR%2FxY%2FWdtoEEjWdr0z29vbkeN8RpR14AYRm7o5ceFLtgfTyFfeO5MMzBQqi3bIl HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 440Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: chromecache_83.2.dr String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_64.2.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: chromecache_69.2.dr, chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: chromecache_69.2.dr, chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: chromecache_73.2.dr, chromecache_89.2.dr, chromecache_78.2.dr, chromecache_77.2.dr String found in binary or memory: https://fontawesome.com
Source: chromecache_73.2.dr, chromecache_89.2.dr, chromecache_78.2.dr, chromecache_77.2.dr String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_69.2.dr, chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&amp;display=swap
Source: chromecache_71.2.dr String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v22/OZpGg_pnoDtINPfRIlLohlvHwQ.woff2)
Source: chromecache_75.2.dr, chromecache_68.2.dr String found in binary or memory: https://getbootstrap.com)
Source: chromecache_75.2.dr, chromecache_68.2.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_68.2.dr String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_66.2.dr String found in binary or memory: https://ka-f.fontawesome.com
Source: chromecache_66.2.dr String found in binary or memory: https://kit.fontawesome.com
Source: chromecache_69.2.dr, chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: chromecache_69.2.dr, chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://outlook.office365.com/Encryption/ErrorPage.aspx?src=3&code=11&be=SN6PR04MB4014&fe=JNAP275CA0
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/aol.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/aol1.png
Source: chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/gmail.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/gmail1.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/office365.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/office3651.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/other1.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/othermail.ico
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/outlook.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/outlook1.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/yahoo.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://storage.googleapis.com/onedrive-d9.appspot.com/images/yahoo1.png
Source: chromecache_82.2.dr, chromecache_63.2.dr, chromecache_64.2.dr String found in binary or memory: https://submit-form.com/4F26MoKMi
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: classification engine Classification label: mal72.phis.win@16/52@20/9
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2036,i,8958638684133180724,12406785168304989187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mitchells-place.pages.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2036,i,8958638684133180724,12406785168304989187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1428992 URL: https://mitchells-place.pag... Startdate: 20/04/2024 Architecture: WINDOWS Score: 72 24 Antivirus / Scanner detection for submitted sample 2->24 26 Yara detected HtmlPhish10 2->26 28 Yara detected HtmlPhish7 2->28 30 2 other signatures 2->30 6 chrome.exe 1 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.4, 138, 443, 49723 unknown unknown 6->14 16 239.255.255.250 unknown Reserved 6->16 11 chrome.exe 6->11         started        process5 dnsIp6 18 a.nel.cloudflare.com 35.190.80.1, 443, 49744, 49748 GOOGLEUS United States 11->18 20 www.google.com 74.125.138.99, 443, 49762, 49788 GOOGLEUS United States 11->20 22 7 other IPs or domains 11->22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
74.125.138.99
 www.google.com United States
15169 GOOGLEUS false
104.18.10.207
 maxcdn.bootstrapcdn.com United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
172.66.47.61
 mitchells-place.pages.dev United States
13335 CLOUDFLARENETUS false
151.101.66.137
 code.jquery.com United States
54113 FASTLYUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
172.66.44.195
 unknown United States
13335 CLOUDFLARENETUS false
104.17.25.14
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.4

Contacted Domains

Name IP Active
a.nel.cloudflare.com 35.190.80.1 true
code.jquery.com 151.101.66.137 true
cdnjs.cloudflare.com 104.17.25.14 true
maxcdn.bootstrapcdn.com 104.18.10.207 true
www.google.com 74.125.138.99 true
mitchells-place.pages.dev 172.66.47.61 true
fp2e7a.wpc.phicdn.net 192.229.211.108 true
ka-f.fontawesome.com unknown unknown
kit.fontawesome.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://mitchells-place.pages.dev/favicon.ico false
    		unknown
    https://a.nel.cloudflare.com/report/v4?s=g1EjkhBuLtN6gREKYIZUG9bm%2FkoSM6%2BpcHbMjjpKTaSYpjMTcEIm42rsqFbpSuu%2BcD8z5Uyh%2Bx1WkU81MnR%2FxY%2FWdtoEEjWdr0z29vbkeN8RpR14AYRm7o5ceFLtgfTyFfeO5MMzBQqi3bIl false
      		high
      https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js false
        		high
        https://mitchells-place.pages.dev/css/hover.css false
          		unknown
          https://mitchells-place.pages.dev/ true
            		unknown
            https://code.jquery.com/jquery-3.2.1.slim.min.js false
              		high
              https://code.jquery.com/jquery-3.1.1.min.js false
                		high
                https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js false
                  		high
                  https://a.nel.cloudflare.com/report/v4?s=Loa3S%2FHVCrqddETuUZwJp%2FwWIO%2BcldR70KHfIYRj%2B0Ylly2OjaRDOH5Kq43m05FFNANAKz2RK2OnT1cE0DqWSt04njc6oKJzafnp2uOxCOHQKGjqg6VOICAP9dvRQFDGIjpES7iAvQ2xoSOc false
                    		high
                    https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css false
                      		high