Analysis Report https://lhklzbenyc.objects-us-east-1.dream.io/liinkk.html#qs=r-abacacfekhccacaeikheababacafeadbfaccagjdacjekaibfgjacb

Overview

General Information

Sample URL: https://lhklzbenyc.objects-us-east-1.dream.io/liinkk.html#qs=r-abacacfekhccacaeikheababacafeadbfaccagjdacjekaibfgjacb
Analysis ID: 322846

Most interesting Screenshot:
Errors
  • URL not reachable

Detection

Phisher
Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Phisher

Classification

Phishing:

barindex
Yara detected Phisher
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\liinkk[1].htm, type: DROPPED
Source: global traffic HTTP traffic detected: GET /qs=r-abacacfekhccacaeikheababacafeadbfaccagjdacjekaibfgjacb HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: gizmoskiff.comConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: lhklzbenyc.objects-us-east-1.dream.io
Source: liinkk[1].htm.2.dr String found in binary or memory: http://gizmoskiff.com/
Source: {A6FA38B5-2FBF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://lhklzbenyc.obj
Source: ~DF2F607BA7733F9ACF.TMP.1.dr String found in binary or memory: https://lhklzbenyc.objects-us-east-1.dream.io/liinkk.html
Source: ~DF2F607BA7733F9ACF.TMP.1.dr, {A6FA38B5-2FBF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://lhklzbenyc.objects-us-east-1.dream.io/liinkk.html#qs=r-abacacfekhccacaeikheababacafeadbfacca
Source: {A6FA38B5-2FBF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://luckyxguy.com/
Source: ~DF2F607BA7733F9ACF.TMP.1.dr String found in binary or memory: https://luckyxguy.com/0/0/0/12b675ea62affcf4faac04f5d20e8bdd/37963_1_11/0_1_0_0_1_1439611_43_1839_70
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49682 -> 443
Source: classification engine Classification label: mal48.phis.win@3/15@4/3
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFB7E7B6F16E3436F0.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5892 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5892 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 322846 URL: https://lhklzbenyc.objects-... Startdate: 26/11/2020 Architecture: WINDOWS Score: 48 20 Yara detected Phisher 2->20 6 iexplore.exe 2 61 2->6         started        process3 process4 8 iexplore.exe 36 6->8         started        dnsIp5 14 luckyxguy.com 111.90.140.95, 443, 49686, 49687 SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY Malaysia 8->14 16 gizmoskiff.com 51.15.153.186, 49684, 49685, 80 OnlineSASFR France 8->16 18 2 other IPs or domains 8->18 12 C:\Users\user\AppData\Local\...\liinkk[1].htm, HTML 8->12 dropped file6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
111.90.140.95
 unknown Malaysia
45839 SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMY false
51.15.153.186
 unknown France
12876 OnlineSASFR false
208.113.201.33
 unknown United States
26347 DREAMHOST-ASUS false

Contacted Domains

Name IP Active
objects-us-east-1.dream.io 208.113.201.33 true
luckyxguy.com 111.90.140.95 true
gizmoskiff.com 51.15.153.186 true
lhklzbenyc.objects-us-east-1.dream.io unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://gizmoskiff.com/qs=r-abacacfekhccacaeikheababacafeadbfaccagjdacjekaibfgjacb false
  • Avira URL Cloud: safe
 unknown