Edit tour

Windows Analysis Report
phish_alert_sp2_2.0.0.0.eml

Overview

General Information

Sample name:	phish_alert_sp2_2.0.0.0.eml
Analysis ID:	1635263
MD5:	1a2101b6a96ce7ce9f484ae7926eddd2
SHA1:	1f49d3ed3a978c2d9fcd48d197261bc8cfb58e7e
SHA256:	7e5674950975996a04037f19b874cf08295341bba43af3152aa2f723a9483db0
Infos:

Detection

KnowBe4

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected KnowBe4 simulated phishing

AI detected landing page (webpage, office document or email)

AI detected suspicious elements in Email content

Creates files inside the system directory

Deletes files inside the Windows folder

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 5740 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\phish_alert_sp2_2.0.0.0.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 3068 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4A255CB3-39EE-428C-9B93-D7A04E3BEDDD" "A11E6A3F-754B-434F-9D26-06CDFD5E26DE" "5740" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 3824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://login.gogie.com.000000000000.phish.farm/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==?cid=2437273701 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2036,i,11391448760171201345,14718212384723619357,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 5740, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match

File source: 1.0.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: Email

Joe Sandbox AI: Email contains prominent button: 'accept & understand'

AI detected suspicious elements in Email content

Source: Email

Joe Sandbox AI: Detected potential phishing email: The email contains suspicious URLs with phishing farm domains. The sender domain 'application-alert.com' is not a legitimate Microsoft/Windows domain. The message creates urgency and requires clicking a suspicious button, typical phishing tactics

Source: Email

Classification: Credential Stealer

Source: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==

HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 184.86.251.28:443 -> 192.168.2.18:49711 version: TLS 1.2

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.99
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.5
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==?cid=2437273701 HTTP/1.1Host: login.gogie.com.000000000000.phish.farmConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ== HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.gogie.com.000000000000.phish.farm/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==?cid=2437273701Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==Accept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /LP_videos/You've_Been_Phished.mp4 HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==Accept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /pages/f2e6f2a95eaf/phished.mp3 HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==Accept-Language: en-US,en;q=0.9Range: bytes=196608-214545If-Range: "6b207845061b2bf9205c8418d478cc0b"
Source: global traffic	HTTP traffic detected: GET /pages/f2e6f2a95eaf/phished.mp3 HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://secured-login.net/pages/f2e6f2a95eaf/phished.mp3Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9If-None-Match: W/"74133370e122c9bb68f488aaad71134d"
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/phished.mp3Accept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==Accept-Language: en-US,en;q=0.9Range: bytes=32768-
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/phished.mp3Accept-Language: en-US,en;q=0.9Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WDVkaGdWbDJYZFlXT2dNQ2hpSDFYU2JEZktCK2w3T1lPOWNtYU9mcTEzTXhhMkVMRk1pRlVpYWVsT0RBVXZqaG5nckl6bC9aZVZEalVyOG4rNkJSa1lFT1VKWGQ4cEZCOEhNSlJER3k3Y0g5cXNBKzc2bEp6YU43MnROMnh6V2tnb0pDNUdkRnN5VkxEQkhUZlN3PT0tLTRQWmJoR2s5VWVORVB6NHotLWRBMmtlWjZoNVp4cUJtdllCczFpa0E9PQ==Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/phished.mp3Accept-Language: en-US,en;q=0.9Range: bytes=196608-
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/phished.mp3Accept-Language: en-US,en;q=0.9Range: bytes=196608-
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/phished.mp3Accept-Language: en-US,en;q=0.9Range: bytes=32768-
Source: global traffic	HTTP traffic detected: GET /LP_videos/hook.wav HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, ;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioSec-Fetch-Storage-Access: activeReferer: https://secured-login.net/pages/f2e6f2a95eaf/phished.mp3Accept-Language: en-US,en;q=0.9Range: bytes=32768-

Source: global traffic	DNS traffic detected: DNS query: login.gogie.com.000000000000.phish.farm
Source: global traffic	DNS traffic detected: DNS query: secured-login.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: helpimg.s3.amazonaws.com

Source: chromecache_64.9.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: chromecache_66.9.dr, chromecache_62.9.dr	String found in binary or memory: https://helpimg.s3.amazonaws.com/LP_videos/You
Source: chromecache_66.9.dr, chromecache_62.9.dr	String found in binary or memory: https://helpimg.s3.amazonaws.com/LP_videos/hook.wav
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://login.gogie.com.000000000000.phish.farm/XNERJVGhPdmdzZGV4Z3hwREY3NzUydjc4dDVkbUVYS1VwbFhIeG5
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://login.gogie.com.000000000000.phish.farm/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://login.gogie.com.000000000000.phish.farm/XcW1ZYzM5U2pISU03bDNqUElsRUd3MVRJS3BHZ29Ud1p2VjlpckN
Source: chromecache_61.9.dr	String found in binary or memory: https://secured-login.net/pages/f2e6f2a95eaf/XSzd4YnRkblh5RmJaK2lOM3pITkVpTzlSeTRQWFhjQllrZXVBSHV1WD
Source: phish_alert_sp2_2.0.0.0.eml	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/0/05/Windows_10_Logo.svg/2560px-Windows_10_Logo

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown

HTTPS traffic detected: 184.86.251.28:443 -> 192.168.2.18:49711 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir3824_1027417652

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir3824_1027417652

Jump to behavior

Source: classification engine

Classification label: mal56.phis.winEML@24/17@10/9