Analysis Report http://bihhwidigojbtkic.lfllavv.com/kampo/Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ==

Overview

General Information

Sample URL: http://bihhwidigojbtkic.lfllavv.com/kampo/Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ==
Analysis ID: 322904

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Phishing site detected (based on favicon image match)
Yara detected HtmlPhish_10
Phishing site detected (based on image similarity)
HTML body contains low number of good links
HTML title does not match URL
Invalid T&C link found

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: http://bihhwidigojbtkic.lfllavv.com/kampo/Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering
Antivirus detection for URL or domain
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

barindex
Phishing site detected (based on favicon image match)
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== Matcher: Template: microsoft matched with high similarity
Yara detected HtmlPhish_10
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\s7m8ltg71guzhecccs888xuj[1].htm, type: DROPPED
Phishing site detected (based on image similarity)
Source: https://sanatiamlak.com/wp-content/upgrade/lib/img/logo2.svg Matcher: Found strong image similarity, brand: Microsoft Jump to dropped file
HTML body contains low number of good links
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: Number of links: 0
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: Number of links: 0
HTML title does not match URL
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: Title: Sign in to your account does not match URL
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: Title: Sign in to your account does not match URL
Invalid T&C link found
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: Invalid link: Terms of use
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: Invalid link: Terms of use
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: No <meta name="author".. found
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: No <meta name="author".. found
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: No <meta name="copyright".. found
Source: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP Parser: No <meta name="copyright".. found
Source: global traffic HTTP traffic detected: GET /kampo/Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: bihhwidigojbtkic.lfllavv.comConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: bihhwidigojbtkic.lfllavv.com
Source: ~DF058445AA7ACBCBBD.TMP.1.dr String found in binary or memory: http://bihhwidigojbtkic.lfllavv.com/kampo/Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ==
Source: {2C0A73F0-2F93-11EB-90EB-ECF4BBEA1588}.dat.1.dr String found in binary or memory: http://bihhwidigojbtkic.lfllavv.com/kampo/Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ==Root
Source: {2C0A73F0-2F93-11EB-90EB-ECF4BBEA1588}.dat.1.dr String found in binary or memory: https://sanatiamlak.coc.lfllavv.com/kampo/Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ==m/wp-content/upgra
Source: Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ==[1].htm.2.dr String found in binary or memory: https://sanatiamlak.com/wp-content/upgrade/?corporate.actions.au2
Source: imagestore.dat.2.dr String found in binary or memory: https://sanatiamlak.com/wp-content/upgrade/lib/img/favicon.ico
Source: imagestore.dat.2.dr String found in binary or memory: https://sanatiamlak.com/wp-content/upgrade/lib/img/favicon.ico~
Source: imagestore.dat.2.dr String found in binary or memory: https://sanatiamlak.com/wp-content/upgrade/lib/img/favicon.ico~(
Source: ~DF058445AA7ACBCBBD.TMP.1.dr String found in binary or memory: https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMz
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: classification engine Classification label: mal76.phis.win@3/16@3/2
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2C0A73EE-2F93-11EB-90EB-ECF4BBEA1588}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFECEF3B821227381B.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6840 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6840 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 322904 URL: http://bihhwidigojbtkic.lfl... Startdate: 26/11/2020 Architecture: WINDOWS Score: 76 15 sanatiamlak.com 2->15 21 Antivirus detection for URL or domain 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 Phishing site detected (based on favicon image match) 2->25 27 2 other signatures 2->27 7 iexplore.exe 1 51 2->7         started        signatures3 process4 process5 9 iexplore.exe 2 43 7->9         started        dnsIp6 17 sanatiamlak.com 185.132.82.145, 443, 49744, 49745 PEJVAK-ERTEBATATIR Iran (ISLAMIC Republic Of) 9->17 19 bihhwidigojbtkic.lfllavv.com 52.186.153.24, 49742, 49743, 80 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 9->19 13 C:\Users\...\s7m8ltg71guzhecccs888xuj[1].htm, HTML 9->13 dropped file7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.132.82.145
 unknown Iran (ISLAMIC Republic Of)
43212 PEJVAK-ERTEBATATIR false
52.186.153.24
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
bihhwidigojbtkic.lfllavv.com 52.186.153.24 true
sanatiamlak.com 185.132.82.145 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://sanatiamlak.com/wp-content/upgrade/s7m8ltg71guzhecccs888xuj.php?MTYwNjM1OTQ4MTZkMDZjNTRlMTMzYjlkYjc1ZjYxZDhiY2U4OTBlZWU4OTcyNmFkYTE1MDk1MWM5OTc5YjQwYzJjMzgwNjE0YTk0OTZiYWE4Zg==&data=Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== true
  • SlashNext: Fake Login Page type: Phishing & Social Engineering
 unknown
http://bihhwidigojbtkic.lfllavv.com/kampo/Y29ycG9yYXRlLmFjdGlvbnMuYXUyQGlnLmNvbQ== true
    		unknown