Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://claytonobrien.autos/twenty/flop/?moontBxm3SRH

Overview

General Information

Sample URL:https://claytonobrien.autos/twenty/flop/?moontBxm3SRH
Analysis ID:1442329
Infos:

Detection

TechSupportScam
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Yara detected TechSupportScam

Classification

  • System is w10x64
  • chrome.exe (PID: 1704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 5300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2248,i,7522220006484712116,13690273053960303007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://claytonobrien.autos/twenty/flop/?moontBxm3SRH" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
dropped/chromecache_69JoeSecurity_TechSupportScamYara detected TechSupportScamJoe Security
    SourceRuleDescriptionAuthorStrings
    0.0.pages.csvJoeSecurity_TechSupportScamYara detected TechSupportScamJoe Security
      0.1.pages.csvJoeSecurity_TechSupportScamYara detected TechSupportScamJoe Security
        No Sigma rule has matched
        No Snort rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHSlashNext: detection malicious, Label: Scareware type: Phishing & Social Engineering
        Source: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAvira URL Cloud: detection malicious, Label: malware
        Source: https://claytonobrien.autos/twenty/flop/Kc13pncO.jsAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/sZq0cGqH.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/4HNPHMfJ.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/nPU7rHwt.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/CW76YE4c.cssAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/tJ67C7xl.cssAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/3FxeivoS.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/LkPf2qhV.mp3Avira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/eGl8WIUk.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/Jv56WYQv.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/4kkzwAOC.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/AiRD0CDb.jsAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/d2If1LR6.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/pgaK9m2J.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/7MALKGdt.pngAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/HQMhxJg0.cssAvira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/jpKzvWhY.mp3Avira URL Cloud: Label: malware
        Source: https://claytonobrien.autos/twenty/flop/6g4S4aZ8.pngAvira URL Cloud: Label: malware

        Phishing

        barindex
        Source: Yara matchFile source: 0.0.pages.csv, type: HTML
        Source: Yara matchFile source: 0.1.pages.csv, type: HTML
        Source: Yara matchFile source: dropped/chromecache_69, type: DROPPED
        Source: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHHTTP Parser: No favicon
        Source: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHHTTP Parser: No favicon
        Source: unknownHTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.4:49755 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.4:49761 version: TLS 1.2
        Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
        Source: unknownTCP traffic detected without corresponding DNS query: 104.46.162.224
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownTCP traffic detected without corresponding DNS query: 23.196.177.159
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /twenty/flop/?moontBxm3SRH HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /twenty/flop/HQMhxJg0.css HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
        Source: global trafficHTTP traffic detected: GET /twenty/flop/CW76YE4c.css HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
        Source: global trafficHTTP traffic detected: GET /twenty/flop/tJ67C7xl.css HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
        Source: global trafficHTTP traffic detected: GET /twenty/flop/AiRD0CDb.js HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
        Source: global trafficHTTP traffic detected: GET /twenty/flop/4HNPHMfJ.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
        Source: global trafficHTTP traffic detected: GET /twenty/flop/4kkzwAOC.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
        Source: global trafficHTTP traffic detected: GE