Windows Analysis Report
https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

Overview

General Information

Sample URL:	https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu
Analysis ID:	1431123
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://microloft.net/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://microloft.net/js/usecure.bundle.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07	Avira URL Cloud: Label: phishing
Source: https://microloft.net/js/usecure.env.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07	Avira URL Cloud: Label: phishing

Phishing

Phishing site detected (based on logo match)

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

Matcher: Template: apple matched

HTML body contains low number of good links

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: Title: Canva does not match URL

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: <input type="password" .../> found

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: No favicon

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: No <meta name="author".. found

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu HTTP/1.1Host: microloft.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/usecure.env.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07 HTTP/1.1Host: microloft.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=euAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/usecure.bundle.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07 HTTP/1.1Host: microloft.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=euAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usecure/wysiwyg1623375071402-USA+Canva+LOGIN1.png HTTP/1.1Host: s3.eu-west-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microloft.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usecure/wysiwyg1605776422557-Depositphotos_99237602_m-2015+4.jpg HTTP/1.1Host: s3.eu-west-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microloft.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usecure/wysiwyg1623375071402-USA+Canva+LOGIN1.png HTTP/1.1Host: s3.eu-west-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usecure/wysiwyg1605776422557-Depositphotos_99237602_m-2015+4.jpg HTTP/1.1Host: s3.eu-west-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: microloft.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=euAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/uPhish/results/visit HTTP/1.1Host: api.usecure.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: microloft.net
Source: global traffic	DNS traffic detected: DNS query: s3.eu-west-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.usecure.io

Source: unknown

HTTP traffic detected: POST /api/uPhish/results/visit HTTP/1.1Host: api.usecure.ioConnection: keep-aliveContent-Length: 14612sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: */*Content-Type: application/x-www-form-urlencoded; charset=UTF-8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://microloft.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://microloft.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.0Date: Wed, 24 Apr 2024 14:03:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 189Connection: closeReport-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1713967381&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&s=0A5qXk0rOhI0hiuw6uTKo33%2FrSd67mt%2BD%2BVRMHIo7%2FI%3D"}]}Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1713967381&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&s=0A5qXk0rOhI0hiuw6uTKo33%2FrSd67mt%2BD%2BVRMHIo7%2FI%3DNel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}X-Powered-By: ExpressAccess-Control-Allow-Origin: *Etag: W/"bd-q+ifm/t1a737L1NUIOELtWJetOI"Via: 1.1 vegur
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 14:03:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeReport-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1713967382&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&s=PWwcXyw6b0v%2FQoRbV04cJJaTtbUFz3NKLDjsSEpyYAE%3D"}]}Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1713967382&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&s=PWwcXyw6b0v%2FQoRbV04cJJaTtbUFz3NKLDjsSEpyYAE%3DNel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}Vary: Origin, Accept-EncodingAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'none'X-Dns-Prefetch-Control: offExpect-Ct: max-age=0Strict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: no-referrerX-Xss-Protection: 0Via: 1.1 vegurCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8796a268387b0add-LASalt-svc: h3=":443"; ma=86400

Source: chromecache_48.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_48.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_53.2.dr	String found in binary or memory: https://api.usecure.io
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2)
Source: chromecache_48.2.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_48.2.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_48.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_53.2.dr	String found in binary or memory: https://na.api.usecure.io
Source: chromecache_48.2.dr	String found in binary or memory: https://sizzlejs.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@20/19@12/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5812 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5812 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.66.43.77	unknown	United States	13335	CLOUDFLARENETUS	false
52.218.1.115	unknown	United States	16509	AMAZON-02US	false
63.32.244.164	microloft.net	United States	16509	AMAZON-02US	false
52.218.120.8	s3.eu-west-1.amazonaws.com	United States	16509	AMAZON-02US	false
172.66.40.179	api.usecure.io	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.141.103	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.4
192.168.2.23

Contacted Domains

Name	IP	Active
s3.eu-west-1.amazonaws.com	52.218.120.8	true
microloft.net	63.32.244.164	true
api.usecure.io	172.66.40.179	true
www.google.com	142.250.141.103	true
fp2e7a.wpc.phicdn.net	192.229.211.108	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://microloft.net/js/usecure.bundle.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07	false	Avira URL Cloud: phishing	unknown
https://api.usecure.io/api/uPhish/results/visit	false	Avira URL Cloud: safe	unknown
https://s3.eu-west-1.amazonaws.com/usecure/wysiwyg1605776422557-Depositphotos_99237602_m-2015+4.jpg	false		high
https://s3.eu-west-1.amazonaws.com/usecure/wysiwyg1623375071402-USA+Canva+LOGIN1.png	false		high
https://microloft.net/js/usecure.env.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07	false	Avira URL Cloud: phishing	unknown
https://microloft.net/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu	true		unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 45	HTML document, ASCII text, with very long lines (11061), with no line terminators	68E71B107BF44064271CF150D61B3DEE	625F48B73A9BAF6B64571212F7B8CC5B0DDC2701	3E2BAB74C40388E97638ACC2F013789BF5AE90206C4544E570E5D4DE92BF2B2D
Chrome Cache Entry: 46	PNG image data, 414 x 246, 8-bit/color RGBA, non-interlaced	343E7603DFCC9BEE1FD63BEB7F95C9B4	1CF856AC46DD1A32294BA5558321E90965C03087	5CA1D84529DDBB8273970AD3DF6814E0A3D9A77725BA545B76720B46292B95D0
Chrome Cache Entry: 47	ASCII text	D1BD2CCAECEA11E5B03418E0AFEED55F	10323192DFB9FFA9B1CD0658A352EBEE9352B208	55BE8B195B7C6725B1BDC62B22AF9F95F2ED7F2DD160A6E3D7AC0177ADD6E2F9
Chrome Cache Entry: 48	Unicode text, UTF-8 text, with very long lines (33574)	5680B969424BB7D67F18EBB020B6CE29	C67C9F1FFEB53E3DD00C8368F67316245F742251	56969550E0E7344EA18E7F1262F207F93C27F4125772B440370344CF51D626A5
Chrome Cache Entry: 49	HTML document, ASCII text, with very long lines (1125)	85B5BE46DDD0320E400A01B15AE710E3	E6C1B45D802B97EA847409194DBE9D024C4313C4	552DFAD3EE6C38A1454343F2E07179E2529FC074F2667F0C76C502ECF7137386
Chrome Cache Entry: 50	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 899x487, components 3	2D4A9BB388DCD1C4F7C89CF509497D0C	5DB2C1FA90B7CFF28F6A42ABF42A0FA917CA0442	2AD1F25D6FF597958C21C2BAF8F81D008B83EFEB0E297355511D6A476C0D79CD
Chrome Cache Entry: 51	HTML document, ASCII text, with no line terminators	C9F6F82C0B1E2D6EB40294F876EAC55E	ABE89F9BFB756BBDFB2F535420E10BB5625EB4E2	9DCC361CF979EA9471E1076AB30724C665229614D2D7432DFE9127C8B6D3A443
Chrome Cache Entry: 52	PNG image data, 414 x 246, 8-bit/color RGBA, non-interlaced	343E7603DFCC9BEE1FD63BEB7F95C9B4	1CF856AC46DD1A32294BA5558321E90965C03087	5CA1D84529DDBB8273970AD3DF6814E0A3D9A77725BA545B76720B46292B95D0
Chrome Cache Entry: 53	ASCII text	D9FE999BFFE058AD04DB8FB08185B999	B2FA85AB5E5E26FA162976655D521CAD9645B91C	7549BAC5F667848983C85E3BA8E22ACF0D6CA930C8DE578998A65A7C498AC6FE
Chrome Cache Entry: 54	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 899x487, components 3	2D4A9BB388DCD1C4F7C89CF509497D0C	5DB2C1FA90B7CFF28F6A42ABF42A0FA917CA0442	2AD1F25D6FF597958C21C2BAF8F81D008B83EFEB0E297355511D6A476C0D79CD
Chrome Cache Entry: 55	ASCII text, with no line terminators	F0D7DE461CA830A3B7F7D7E48AF93592	72F9969CBE7C2B09CF980D57ACF677C3909E9EDD	315EDE44AAD553BF8C69F560B912E4EC0A74A3AA92FACFBA81ABA0520226F0AD

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: https://microloft.net/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://microloft.net/js/usecure.bundle.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07	Avira URL Cloud: Label: phishing
Source: https://microloft.net/js/usecure.env.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07	Avira URL Cloud: Label: phishing

Phishing

Phishing site detected (based on logo match)

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

Matcher: Template: apple matched

HTML body contains low number of good links

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: Title: Canva does not match URL

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: <input type="password" .../> found

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: No favicon

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: No <meta name="author".. found

Source: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu HTTP/1.1Host: microloft.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/usecure.env.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07 HTTP/1.1Host: microloft.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=euAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/usecure.bundle.js?v=17d8e600-dc4e-48d2-9bf0-3b598830db07 HTTP/1.1Host: microloft.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=euAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usecure/wysiwyg1623375071402-USA+Canva+LOGIN1.png HTTP/1.1Host: s3.eu-west-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microloft.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usecure/wysiwyg1605776422557-Depositphotos_99237602_m-2015+4.jpg HTTP/1.1Host: s3.eu-west-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microloft.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usecure/wysiwyg1623375071402-USA+Canva+LOGIN1.png HTTP/1.1Host: s3.eu-west-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usecure/wysiwyg1605776422557-Depositphotos_99237602_m-2015+4.jpg HTTP/1.1Host: s3.eu-west-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: microloft.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=euAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/uPhish/results/visit HTTP/1.1Host: api.usecure.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: microloft.net
Source: global traffic	DNS traffic detected: DNS query: s3.eu-west-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.usecure.io

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.0Date: Wed, 24 Apr 2024 14:03:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 189Connection: closeReport-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1713967381&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&s=0A5qXk0rOhI0hiuw6uTKo33%2FrSd67mt%2BD%2BVRMHIo7%2FI%3D"}]}Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1713967381&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&s=0A5qXk0rOhI0hiuw6uTKo33%2FrSd67mt%2BD%2BVRMHIo7%2FI%3DNel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}X-Powered-By: ExpressAccess-Control-Allow-Origin: *Etag: W/"bd-q+ifm/t1a737L1NUIOELtWJetOI"Via: 1.1 vegur
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 14:03:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeReport-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1713967382&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&s=PWwcXyw6b0v%2FQoRbV04cJJaTtbUFz3NKLDjsSEpyYAE%3D"}]}Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1713967382&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&s=PWwcXyw6b0v%2FQoRbV04cJJaTtbUFz3NKLDjsSEpyYAE%3DNel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}Vary: Origin, Accept-EncodingAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'none'X-Dns-Prefetch-Control: offExpect-Ct: max-age=0Strict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: no-referrerX-Xss-Protection: 0Via: 1.1 vegurCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8796a268387b0add-LASalt-svc: h3=":443"; ma=86400

Source: chromecache_48.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_48.2.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_53.2.dr	String found in binary or memory: https://api.usecure.io
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lqDY.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2)
Source: chromecache_47.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2)
Source: chromecache_48.2.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_48.2.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_48.2.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_53.2.dr	String found in binary or memory: https://na.api.usecure.io
Source: chromecache_48.2.dr	String found in binary or memory: https://sizzlejs.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.4:49748 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@20/19@12/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5812 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5812 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 --field-trial-handle=1912,i,7823971302079770909,13188878066435612919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1431123
Product:	CloudBasic
Start time:	16:01:58
Start date:	24.04.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://microloft.net/?r=8e28e856-be8d-4446-a396-cdcd78169ab8&rg=eu