Analysis Report Payment conflict- aptiv 082920134110.htm

Overview

General Information

Sample Name: Payment conflict- aptiv 082920134110.htm
Analysis ID: 321240
MD5: 3f7d70ccc4f96a097a583691dd149f7b
SHA1: 3c5695cc2d60c55cc28716b73a494d05bb8d1cc1
SHA256: bb5a0ae3ec35fc0084ad4e530a8904d2918120d7c18ccad3259436c4ed3a8a0b

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Phishing site detected (based on favicon image match)
Yara detected HtmlPhish_10
Yara detected obfuscated html page
Obfuscated HTML file found
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://jutebagbd.com/i1uwpq/qey6392/authorize_client_id:1gylt35o-e7u6-gwvj-v4zg-4cutdk8lh6wq_atv4duzi6osgxypq0fb5rw3m819ckje27lhn17o6jhs8cike4mfx3gytv905dbrqzwunpla2nws6vafbkoy9x0jq8mu3lzdth1pcir52g74e?data=ZW9pbi5tdWxkb3duZXlAYXB0aXYuY29t SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://jutebagbd.com/i1uwpq/qey6392/authorize_client_id:1gylt35o-e7u6-gwvj-v4zg-4cutdk8lh6wq_atv4duzi6osgxypq0fb5rw3m819ckje27lhn17o6jhs8cike4mfx3gytv905dbrqzwunpla2nws6vafbkoy9x0jq8mu3lzdth1pcir52g74e?data=ZW9pbi5tdWxkb3duZXlAYXB0aXYuY29t UrlScan: Label: phishing brand: microsoft Perma Link
Multi AV Scanner detection for domain / URL
Source: jutebagbd.com Virustotal: Detection: 9% Perma Link

Phishing:

barindex
Phishing site detected (based on favicon image match)
Source: https://jutebagbd.com/i1uwpq/qey6392/authorize_client_id:1gylt35o-e7u6-gwvj-v4zg-4cutdk8lh6wq_atv4duzi6osgxypq0fb5rw3m819ckje27lhn17o6jhs8cike4mfx3gytv905dbrqzwunpla2nws6vafbkoy9x0jq8mu3lzdth1pcir52g74e?data=ZW9pbi5tdWxkb3duZXlAYXB0aXYuY29t Matcher: Template: microsoft matched with high similarity
Yara detected HtmlPhish_10
Source: Yara match File source: 820094.pages.csv, type: HTML
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\authorize_client_id_1gylt35o-e7u6-gwvj-v4zg-4cutdk8lh6wq_atv4duzi6osgxypq0fb5rw3m819ckje27lhn17o6jhs8cike4mfx3gytv905dbrqzwunpla2nws6vafbkoy9x0jq8mu3lzdth1pcir52g74e[1].htm, type: DROPPED
Yara detected obfuscated html page
Source: Yara match File source: Payment conflict- aptiv 082920134110.htm, type: SAMPLE

Networking:

barindex
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown DNS traffic detected: queries for: jutebagbd.com
Source: authorize_client_id_1gylt35o-e7u6-gwvj-v4zg-4cutdk8lh6wq_atv4duzi6osgxypq0fb5rw3m819ckje27lhn17o6jhs8cike4mfx3gytv905dbrqzwunpla2nws6vafbkoy9x0jq8mu3lzdth1pcir52g74e[1].htm.2.dr String found in binary or memory: https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN_r8OUuhs.ttf)
Source: {F19D7E13-2B48-11EB-90EB-ECF4BBEA1588}.dat.1.dr String found in binary or memory: https://jutebagbd.com//Desktop/Payment%20conflict-%20aptiv%20082920134110.htmi1uwpq/qey6392/authoriz
Source: qey6392[1].htm.2.dr String found in binary or memory: https://jutebagbd.com/i1uwpq/qey6392/?eoin.muldowney
Source: ~DF377151FFA9B95D32.TMP.1.dr String found in binary or memory: https://jutebagbd.com/i1uwpq/qey6392/authorize_client_id:1gylt35o-e7u6-gwvj-v4zg-4cutdk8lh6wq_atv4du
Source: imagestore.dat.2.dr String found in binary or memory: https://jutebagbd.com/i1uwpq/qey6392/images/favicon.ico~
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: classification engine Classification label: mal84.phis.evad.winHTM@3/20@2/1
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F19D7E11-2B48-11EB-90EB-ECF4BBEA1588}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF1E46B92F2D8AF763.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6864 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6864 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Data Obfuscation:

barindex
Obfuscated HTML file found
Source: Payment conflict- aptiv 082920134110.htm Initial file: Did not found title: "HTML Meta Tag" in HTML/HTM content
Source: Payment conflict- aptiv 082920134110.htm Initial file: Did not found title: "HTML Meta Tag" in HTML/HTM content
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321240 Sample: Payment conflict- aptiv 082... Startdate: 20/11/2020 Architecture: WINDOWS Score: 84 15 jutebagbd.com 2->15 19 Multi AV Scanner detection for domain / URL 2->19 21 Antivirus detection for URL or domain 2->21 23 Phishing site detected (based on favicon image match) 2->23 25 3 other signatures 2->25 7 iexplore.exe 1 54 2->7         started        signatures3 process4 process5 9 iexplore.exe 2 47 7->9         started        dnsIp6 17 jutebagbd.com 198.54.116.10, 443, 49739, 49740 NAMECHEAP-NETUS United States 9->17 13 authorize_client_i...h1pcir52g74e[1].htm, data 9->13 dropped file7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.54.116.10
 unknown United States
22612 NAMECHEAP-NETUS true

Contacted Domains

Name IP Active
jutebagbd.com 198.54.116.10 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://jutebagbd.com/i1uwpq/qey6392/authorize_client_id:1gylt35o-e7u6-gwvj-v4zg-4cutdk8lh6wq_atv4duzi6osgxypq0fb5rw3m819ckje27lhn17o6jhs8cike4mfx3gytv905dbrqzwunpla2nws6vafbkoy9x0jq8mu3lzdth1pcir52g74e?data=ZW9pbi5tdWxkb3duZXlAYXB0aXYuY29t true
  • 100%, UrlScan, Browse
  • SlashNext: Fake Login Page type: Phishing & Social Engineering
 unknown