Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ATTT003.html

Overview

General Information

Sample name:ATTT003.html
Analysis ID:1603368
MD5:604da52144d35f2d5f801d1482fec1f5
SHA1:89d909fd02d57a958d3424a2f85afc4715190ffc
SHA256:c70ff4bd38df72649b1f1f5bbf7d97cc15bd8238b5e6f8869f1a891090d82e37
Infos:

Detection

HTMLPhisher
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

AI detected phishing page
Yara detected HtmlPhish10
Detected javascript redirector / loader
HTML document with suspicious title
HTML file submission containing password form
HTML sample is only containing javascript code
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML title does not match URL
IP address seen in connection with other malware
Invalid T&C link found
None HTTPS page querying sensitive user data (password, username or email)

Classification

  • System is w10x64
  • chrome.exe (PID: 2228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ATTT003.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 2720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2168,i,3316645514110432410,7898433569318208782,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
2.3.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
    1.1.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
      1.2.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security
        No Sigma rule has matched
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        Phishing

        barindex
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlJoe Sandbox AI: Score: 10 Reasons: HTML file with login form DOM: 1.1.pages.csv
        Source: Yara matchFile source: 2.3.pages.csv, type: HTML
        Source: Yara matchFile source: 1.1.pages.csv, type: HTML
        Source: Yara matchFile source: 1.2.pages.csv, type: HTML
        Source: ATTT003.htmlHTTP Parser: Low number of body elements: 0
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlTab title: Sign in to your account
        Source: file:///C:/Users/user/Desktop/ATTT003.html#Tab title: Sign in to your account
        Source: ATTT003.htmlHTTP Parser: <script>let rh13z8jemt = 'bWFydHlfZnJlZW1hbkBjaHVnYWNoZWxlY3RyaWMuY29t'; // Consequat pork pariatur frankfurter reprehenderit minim laboris beef pig.var YsSwxT$jzcRAKJUa_Uo=TbhzMjORY;function V$_IiKH(){var KARqiDgmLyarmNO=['f8f8fcfbbda89db39dae',...
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: Number of links: 0
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: Number of links: 0
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: <input type="password" .../> found but no <form action="...
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: <input type="password" .../> found but no <form action="...
        Source: ATTT003.htmlHTTP Parser: Base64 decoded: marty_freeman@chugachelectric.com
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: Title: Sign in to your account does not match URL
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: Title: Sign in to your account does not match URL
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: Invalid link: Privacy statement
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: Invalid link: Privacy statement
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: Invalid link: Privacy statement
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: Has password / email / username input fields
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: Has password / email / username input fields
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: <input type="password" .../> found
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: <input type="password" .../> found
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: No favicon
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: No favicon
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: No favicon
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: No favicon
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: No <meta name="author".. found
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: No <meta name="author".. found
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: No <meta name="author".. found
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: No <meta name="copyright".. found
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: No <meta name="copyright".. found
        Source: file:///C:/Users/user/Desktop/ATTT003.html#HTTP Parser: No <meta name="copyright".. found
        Source: Joe Sandbox ViewIP Address: 104.21.48.1 104.21.48.1
        Source: Joe Sandbox ViewIP Address: 104.21.48.1 104.21.48.1
        Source: Joe Sandbox ViewIP Address: 104.17.24.14 104.17.24.14
        Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
        Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
        Source: unknownTCP traffic detected without corresponding DNS query: 199.232.214.172
        Source: unknownTCP traffic detected without corresponding DNS query: 2.16.164.97
        Source: unknownTCP traffic detected without corresponding DNS query: 2.16.164.97
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /attach%2Fbootstrap.min.js HTTP/1.1Host: 1419993777-1317754460.cos.ap-singapore.myqcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /attach%2Fbootstrap.min.js HTTP/1.1Host: 1419993777-1317754460.cos.ap-singapore.myqcloud.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /next.php HTTP/1.1Host: ableg.filevaultaccounting.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /next.php HTTP/1.1Host: ableg.filevaultaccounting.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /next.php HTTP/1.1Host: ableg.filevaultaccounting.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficHTTP traffic detected: GET /next.php HTTP/1.1Host: ableg.filevaultaccounting.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: global trafficDNS traffic detected: DNS query: code.jquery.com
        Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
        Source: global trafficDNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
        Source: global trafficDNS traffic detected: DNS query: stackpath.bootstrapcdn.com
        Source: global trafficDNS traffic detected: DNS query: 1419993777-1317754460.cos.ap-singapore.myqcloud.com
        Source: global trafficDNS traffic detected: DNS query: ableg.filevaultaccounting.com
        Source: global trafficDNS traffic detected: DNS query: www.google.com
        Source: global trafficDNS traffic detected: DNS query: aadcdn.msftauth.net
        Source: unknownHTTP traffic detected: POST /next.php HTTP/1.1Host: ableg.filevaultaccounting.comConnection: keep-aliveContent-Length: 13sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
        Source: chromecache_85.1.dr, chromecache_84.1.drString found in binary or memory: http://opensource.org/licenses/MIT).
        Source: chromecache_75.1.dr, chromecache_87.1.drString found in binary or memory: https://getbootstrap.com)
        Source: chromecache_80.1.dr, chromecache_83.1.drString found in binary or memory: https://getbootstrap.com/)
        Source: chromecache_75.1.dr, chromecache_87.1.dr, chromecache_80.1.dr, chromecache_83.1.drString found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
        Source: chromecache_75.1.dr, chromecache_87.1.dr, chromecache_80.1.dr, chromecache_83.1.drString found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50056
        Source: unknownNetwork traffic detected: HTTP traffic on port 50055 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50055
        Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
        Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
        Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 50056 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
        Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
        Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
        Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
        Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
        Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
        Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
        Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
        Source: classification engineClassification label: mal72.phis.winHTML@24/27@32/14
        Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ATTT003.html"
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2168,i,3316645514110432410,7898433569318208782,262144 /prefetch:8
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2168,i,3316645514110432410,7898433569318208782,262144 /prefetch:8Jump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
        Source: Window RecorderWindow detected: More than 3 window changes detected

        Stealing of Sensitive Information

        barindex
        Source: file:///C:/Users/user/Desktop/ATTT003.htmlHTTP Parser: file:///C:/Users/user/Desktop/ATTT003.html
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
        Process Injection
        1
        Process Injection
        OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media3
        Non-Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive4
        Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Ingress Tool Transfer
        Traffic DuplicationData Destruction
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches
        SourceDetectionScannerLabelLink
        file:///C:/Users/user/Desktop/ATTT003.html#0%Avira URL Cloudsafe
        file:///C:/Users/user/Desktop/ATTT003.html0%Avira URL Cloudsafe
        https://ableg.filevaultaccounting.com/next.php0%Avira URL Cloudsafe
        https://1419993777-1317754460.cos.ap-singapore.myqcloud.com/attach%2Fbootstrap.min.js0%Avira URL Cloudsafe
        NameIPActiveMaliciousAntivirus DetectionReputation
        stackpath.bootstrapcdn.com
        104.18.10.207
        truefalse
          high
          sgp.file.myqcloud.com
          43.153.232.152
          truefalse
            high
            e329293.dscd.akamaiedge.net
            2.23.209.25
            truefalse
              high
              ableg.filevaultaccounting.com
              104.21.32.1
              truefalse
                unknown
                code.jquery.com
                151.101.130.137
                truefalse
                  high
                  cdnjs.cloudflare.com
                  104.17.24.14
                  truefalse
                    high
                    maxcdn.bootstrapcdn.com
                    104.18.10.207
                    truefalse
                      high
                      s-part-0017.t-0009.t-msedge.net
                      13.107.246.45
                      truefalse
                        high
                        www.google.com
                        142.250.74.196
                        truefalse
                          high
                          1419993777-1317754460.cos.ap-singapore.myqcloud.com
                          unknown
                          unknownfalse
                            unknown
                            aadcdn.msftauth.net
                            unknown
                            unknownfalse
                              high
                              NameMaliciousAntivirus DetectionReputation
                              https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jsfalse
                                high
                                https://code.jquery.com/jquery-3.2.1.slim.min.jsfalse
                                  high
                                  file:///C:/Users/user/Desktop/ATTT003.htmltrue
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svgfalse
                                    high
                                    file:///C:/Users/user/Desktop/ATTT003.html#true
                                    • Avira URL Cloud: safe
                                    unknown
                                    https://ableg.filevaultaccounting.com/next.phpfalse
                                    • Avira URL Cloud: safe
                                    unknown
                                    https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.jsfalse
                                      high
                                      https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.jsfalse
                                        high
                                        https://1419993777-1317754460.cos.ap-singapore.myqcloud.com/attach%2Fbootstrap.min.jsfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        NameSourceMaliciousAntivirus DetectionReputation
                                        https://github.com/twbs/bootstrap/graphs/contributors)chromecache_75.1.dr, chromecache_87.1.dr, chromecache_80.1.dr, chromecache_83.1.drfalse
                                          high
                                          https://getbootstrap.com)chromecache_75.1.dr, chromecache_87.1.drfalse
                                            high
                                            https://github.com/twbs/bootstrap/blob/master/LICENSE)chromecache_75.1.dr, chromecache_87.1.dr, chromecache_80.1.dr, chromecache_83.1.drfalse
                                              high
                                              http://opensource.org/licenses/MIT).chromecache_85.1.dr, chromecache_84.1.drfalse
                                                high
                                                https://getbootstrap.com/)chromecache_80.1.dr, chromecache_83.1.drfalse
                                                  high
                                                  • No. of IPs < 25%
                                                  • 25% < No. of IPs < 50%
                                                  • 50% < No. of IPs < 75%
                                                  • 75% < No. of IPs
                                                  IPDomainCountryFlagASNASN NameMalicious
                                                  104.21.48.1
                                                  unknownUnited States
                                                  13335CLOUDFLARENETUSfalse
                                                  104.17.24.14
                                                  cdnjs.cloudflare.comUnited States
                                                  13335CLOUDFLARENETUSfalse
                                                  2.23.209.25
                                                  e329293.dscd.akamaiedge.netEuropean Union
                                                  1273CWVodafoneGroupPLCEUfalse
                                                  142.250.185.68
                                                  unknownUnited States
                                                  15169GOOGLEUSfalse
                                                  104.18.10.207
                                                  stackpath.bootstrapcdn.comUnited States
                                                  13335CLOUDFLARENETUSfalse
                                                  104.21.32.1
                                                  ableg.filevaultaccounting.comUnited States
                                                  13335CLOUDFLARENETUSfalse
                                                  151.101.130.137
                                                  code.jquery.comUnited States
                                                  54113FASTLYUSfalse
                                                  104.18.11.207
                                                  unknownUnited States
                                                  13335CLOUDFLARENETUSfalse
                                                  239.255.255.250
                                                  unknownReserved
                                                  unknownunknownfalse
                                                  43.153.232.152
                                                  sgp.file.myqcloud.comJapan4249LILLY-ASUSfalse
                                                  151.101.194.137
                                                  unknownUnited States
                                                  54113FASTLYUSfalse
                                                  142.250.74.196
                                                  www.google.comUnited States
                                                  15169GOOGLEUSfalse
                                                  IP
                                                  192.168.2.16
                                                  192.168.2.4
                                                  Joe Sandbox version:42.0.0 Malachite
                                                  Analysis ID:1603368
                                                  Start date and time:2025-01-30 22:11:28 +01:00
                                                  Joe Sandbox product:CloudBasic
                                                  Overall analysis duration:0h 5m 36s
                                                  Hypervisor based Inspection enabled:false
                                                  Report type:full
                                                  Cookbook file name:defaultwindowshtmlcookbook.jbs
                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                  Number of analysed new started processes analysed:7
                                                  Number of new started drivers analysed:0
                                                  Number of existing processes analysed:0
                                                  Number of existing drivers analysed:0
                                                  Number of injected processes analysed:0
                                                  Technologies:
                                                  • EGA enabled
                                                  • AMSI enabled
                                                  Analysis Mode:default
                                                  Analysis stop reason:Timeout
                                                  Sample name:ATTT003.html
                                                  Detection:MAL
                                                  Classification:mal72.phis.winHTML@24/27@32/14
                                                  Cookbook Comments:
                                                  • Found application associated with file extension: .html
                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                  • Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.185.110, 64.233.184.84, 142.250.185.138, 216.58.212.142, 142.250.74.202, 142.250.184.206, 142.250.185.170, 216.58.212.170, 142.250.186.106, 142.250.185.202, 142.250.185.234, 142.250.185.106, 142.250.184.202, 142.250.186.42, 142.250.186.138, 142.250.186.170, 142.250.181.234, 216.58.206.74, 142.250.186.74, 172.217.16.202, 217.20.57.35, 2.23.77.188, 142.250.186.174, 216.58.206.78, 142.250.185.142, 142.250.185.238, 216.58.206.67, 172.217.18.14, 142.250.186.110, 142.250.185.78, 142.250.184.238, 184.28.90.27, 13.107.246.45, 20.109.210.53
                                                  • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, optimizationguide-pa.googleapis.com
                                                  • Not all processes where analyzed, report is missing behavior information
                                                  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                  • VT rate limit hit for: ATTT003.html
                                                  No simulations