Analysis Report sc.com

Overview

General Information

Sample Name: sc.com
Analysis ID: 321434
MD5: a2f3a68db7863f4da11cf0255a4969e4
SHA1: fe611bbce708b77bab1b9c31eb3dd30c4a7b763a
SHA256: 5411a2337cd4c63d1b0740ca513bc5c958b37777f10de80f96217368a3191b89

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish_10

Classification

Phishing:

barindex
Yara detected HtmlPhish_10
Source: Yara match File source: sc.com, type: SAMPLE
Source: sc.com String found in binary or memory: https://i.ibb.co/7CKgHCt/ep.png
Source: sc.com String found in binary or memory: https://i.ibb.co/9qFGmjh/miciconlogo.png
Source: sc.com String found in binary or memory: https://i.ibb.co/F3yr74z/forgotpass.png
Source: sc.com String found in binary or memory: https://i.ibb.co/gtKmtC9/officebg.png
Source: sc.com String found in binary or memory: https://i.ibb.co/r5zjhmN/officebg2.png
Source: sc.com String found in binary or memory: https://passwordreset.microsoftonline.com/
Source: sc.com String found in binary or memory: https://pikap.kz/wp-admin/wed/server5.php
Source: classification engine Classification label: mal48.phis.winCOM@4/5@0/0
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFF37C87F1E61570B4.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5624 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5624 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Run
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 321434 Sample: sc.com Startdate: 22/11/2020 Architecture: WINDOWS Score: 48 10 Yara detected HtmlPhish_10 2->10 6 iexplore.exe 3 63 2->6         started        process3 process4 8 iexplore.exe 18 6->8         started       
No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
0 true low