Edit tour

Windows Analysis Report
https://mail.kb4.io/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ

Overview

General Information

Sample URL:	https://mail.kb4.io/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZ
Analysis ID:	1486301

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Phishing site detected (based on image similarity)

HTML body contains low number of good links

Invalid 'forgot password' link found

Invalid T&C link found

No HTML title found

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mail.kb4.io/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==?cid=2106172740 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1912,i,3803306437769763996,1968567763980251616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on image similarity)

Source: https://secured-login.net/pages/4c2f13e264408/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==

Matcher: Found strong image similarity, brand: GOOGLE

HTTP Parser: Number of links: 0

HTTP Parser: Invalid link: Forgot password?

Source: https://secured-login.net/pages/4c2f13e264408/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==	HTTP Parser: Invalid link: Help
Source: https://secured-login.net/pages/4c2f13e264408/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==	HTTP Parser: Invalid link: Privacy
Source: https://secured-login.net/pages/4c2f13e264408/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==	HTTP Parser: Invalid link: Terms
Source: https://secured-login.net/pages/4c2f13e264408/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==	HTTP Parser: Invalid link: Help
Source: https://secured-login.net/pages/4c2f13e264408/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==	HTTP Parser: Invalid link: Privacy
Source: https://secured-login.net/pages/4c2f13e264408/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==	HTTP Parser: Invalid link: Terms

HTTP Parser: HTML title missing

HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49723 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 27MB later: 36MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: mail.kb4.io
Source: global traffic	DNS traffic detected: DNS query: secured-login.net
Source: global traffic	DNS traffic detected: DNS query: pluspng.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49723 version: TLS 1.2

Source: classification engine

Classification label: sus22.phis.win@15/12@12/135

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://mail.kb4.io/XQlAraGFuWWVqM1UzeXhHbzVFWnBvVEplMEEzeWFqSmhXcmJxQ2UwRDN5SjNoWWZucUt1eitWUCt2ZmZzNllobFU0cG5VaTA1QzdZVXM0YVNqRjJaNXZ2TDNDQXA1ZEtmV1ZBbnlackpZVGRPUFZLUm1wOEZHYmg0MWp0QVFiM2lOU291RGZLUlFoZkRhT0NINEE2SFZxRkcxZ1Rqak04U20wbWhSa3pZMVhpY3NROXB4enYxL2RVU1B2bz0tLXJKakJIWDMzVS8xcEFveUstLUZ3Z05rRGh0Umlydi9waGJRcUpVeWc9PQ==?cid=2106172740
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1912,i,3803306437769763996,1968567763980251616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1912,i,3803306437769763996,1968567763980251616,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails