Analysis Report #U03bd#U03bf#U0456#U0441#U0435m#U0430#U0456l202114170492f#U0433#U03bfm+19796076561 19796076561.HTM

Overview

General Information

Sample Name:	#U03bd#U03bf#U0456#U0441#U0435m#U0430#U0456l202114170492f#U0433#U03bfm+19796076561 19796076561.HTM
Analysis ID:	339225
MD5:	a459550229cce40c15f886dc9ba3bcd8
SHA1:	5f3bc52767b84da9b1febc37e4fa90046a8900d1
SHA256:	3cbf7d91c4bc9c1b5d0955d19c038408843b49b9b20e02a995b45792f72a0d8c
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish_10

Yara detected obfuscated html page

Obfuscated HTML file found

JA3 SSL client fingerprint seen in connection with other malware

Classification

Signatures

AV Detection:

Antivirus detection for URL or domain

Source: https://iccisc.com/images/new/sense/authorize_client_id:6yamswq8-z0x3-g8qm-rhyk-607iytq3huoc_kg8mla43sejbi17xcvowr2h9fnp5du6tqzy0zn8705xdg6a2o4yelkpbt9u31ismhqcvwfrjt3h5igr8zpdbeo4nq67ywc1af2mlu9vjkxs0?data=YmlrcmFtLmd1cnVuZ0BicmV3aW4uY28udWs=

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Phishing site detected (based on favicon image match)

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish_10

Source: Yara match	File source: 767668.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\authorize_client_id_6yamswq8-z0x3-g8qm-rhyk-607iytq3huoc_kg8mla43sejbi17xcvowr2h9fnp5du6tqzy0zn8705xdg6a2o4yelkpbt9u31ismhqcvwfrjt3h5igr8zpdbeo4nq67ywc1af2mlu9vjkxs0[1].htm, type: DROPPED

Yara detected obfuscated html page

Source: Yara match

File source: #U03bd#U03bf#U0456#U0441#U0435m#U0430#U0456l202114170492f#U0433#U03bfm+19796076561 19796076561.HTM, type: SAMPLE

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 103.27.87.65:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.27.87.65:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.27.87.65:443 -> 192.168.2.4:49732 version: TLS 1.2

Networking:

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS traffic detected: queries for: iccisc.com

Source: authorize_client_id_6yamswq8-z0x3-g8qm-rhyk-607iytq3huoc_kg8mla43sejbi17xcvowr2h9fnp5du6tqzy0zn8705xdg6a2o4yelkpbt9u31ismhqcvwfrjt3h5igr8zpdbeo4nq67ywc1af2mlu9vjkxs0[1].htm.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v16/mem5YaGs126MiZpBA-UN_r8OUuhs.ttf)
Source: {E40FA487-55BE-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://iccisc.com/ima
Source: ~DF2C3DE4B398643922.TMP.1.dr	String found in binary or memory: https://iccisc.com/images/new/sense/authorize_client_id:6yamswq8-z0x3-g8qm-rhyk-607iytq3huoc_kg8mla4
Source: imagestore.dat.2.dr	String found in binary or memory: https://iccisc.com/images/new/sense/images/favicon.ico~

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 103.27.87.65:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.27.87.65:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.27.87.65:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.evad.winHTM@3/19@2/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E40FA485-55BE-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF36A0BF1EB91DC84B.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3136 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3136 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Confirm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

Obfuscated HTML file found

Source: #U03bd#U03bf#U0456#U0441#U0435m#U0430#U0456l202114170492f#U0433#U03bfm+19796076561 19796076561.HTM

Initial file: Did not found title: "Voice message" in HTML/HTM content

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.27.87.65	unknown	India		18229	CTRLS-AS-INCtrlSDatacentersLtdIN	false

Contacted Domains

Name	IP	Active
iccisc.com	103.27.87.65	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://iccisc.com/images/new/sense/authorize_client_id:6yamswq8-z0x3-g8qm-rhyk-607iytq3huoc_kg8mla43sejbi17xcvowr2h9fnp5du6tqzy0zn8705xdg6a2o4yelkpbt9u31ismhqcvwfrjt3h5igr8zpdbeo4nq67ywc1af2mlu9vjkxs0?data=YmlrcmFtLmd1cnVuZ0BicmV3aW4uY28udWs=	true	SlashNext: Fake Login Page type: Phishing & Social Engineering	unknown

ID:	339225
Product:	CloudBasic
Start time:	17:45:38
Start date:	13.01.2021
Sample:	#U03bd#U03bf#U0456#U0441#U0435m#U0430#U0456l202114170492f#U0433#U03bfm+19796076561 19796076561.HTM
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	a459550229cce40c15f886dc9ba3bcd8
SHA1:	5f3bc52767b84da9b1febc37e4fa90046a8900d1
SHA256:	3cbf7d91c4bc9c1b5d0955d19c038408843b49b9b20e02a995b45792f72a0d8c

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E40FA485-55BE-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	024B9BDDBECC4A6AA31BCE45248645BB	D50374ABAE4322315226476D5019641758C76E20	D78B31ABDC9F3CE8990231C83DCDA0A60AA8CA0A3E24D71F0D4DC94CBF8A010B
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E40FA487-55BE-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	B1949525005F30BDC3769E885B600A2C	A47EE12A9B0EBC350A95E8CD87A1796AB3DA6A6C	F43F2F0B17BE9B03A469B53DDB204E84271F387B6CD222EA549BCF91F09A9471
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EB50EAA9-55BE-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	5D730A2EEF44E1A63C518B06CA75786D	5E165C2F88FDDDE57C4EDC413D18557090BC45A3	225AED534A5C263FC15DEF625024246E81760E988658FE3A26C45061DF88F911
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat	data	6B8062F4E7E810456C4496F4C271F64D	E23AD91C257D52ABB8B56DD833E2DDF25F6C866A	C5D83D79246C07160006712D10E3CD30C7960ACE30DDD5A79C57D62DAEE6FA48
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\arrow_left[1].svg	SVG Scalable Vector Graphics image	A9CC2824EF3517B6C4160DCF8FF7D410	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\authorize_client_id_6yamswq8-z0x3-g8qm-rhyk-607iytq3huoc_kg8mla43sejbi17xcvowr2h9fnp5du6tqzy0zn8705xdg6a2o4yelkpbt9u31ismhqcvwfrjt3h5igr8zpdbeo4nq67ywc1af2mlu9vjkxs0[1].htm	data	D2CAAD6F61BE3F9E109452090898371A	4A7A0AFF9B81EE84E6E7FDB92CE4849C60E29A17	F0443747EA394F0CDE5E0D6652A86D722FC363CC4AC6EBC859D39B5022F2F104
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\favicon[3].ico	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	7CDD5A7E87E82D145E7F82358F9EBD04	265104CAD00300E4094F8CE6A9EDC86E54812EAD	5D91563B6ACD54468AE282083CF9EE3D2C9B2DAA45A8DE9CB661C2195B9F6CBF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\style[1].css	ASCII text, with very long lines, with no line terminators	9F94F80A5DC09BB962778175292195BC	A7F2E32B422AC9654F39EA870E403599791FCE1C	1CF4B3AD7ABF3189E78C1B3BD07308C92A03FA795FDBC5821FCDE24030CFEAD0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\forgpass[1].png	PNG image data, 121 x 20, 8-bit/color RGB, non-interlaced	B19CAC60E41C79BD974C1080088C6FEF	FFE553D8CA430DD309494E910A989271648A4DDD	E29DB32031DC537AEE9CB557B408395F3324F1E0F744349C0CDF943A3AF39296
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\passwrd[1].png	PNG image data, 69 x 34, 8-bit/color RGBA, non-interlaced	4F2A1D382216546E2C3BC620497FD4E3	F785EC5967B5666387304F779306F9C3E3359FF4	105C03D3360CDB953585482374B2CC953D090741037502B0609629F5BB0135B7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\sigin[1].png	PNG image data, 108 x 32, 8-bit/color RGBA, non-interlaced	681B83E88BA6AACCC72705FBF9F2257B	D69957C47026108511225160BE9BD15788D26E14	F32A760F15530284447282AF5C7D0825BABF8BC4739E073928F6128830819F7A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ellipsis_grey[1].svg	SVG Scalable Vector Graphics image	2B5D393DB04A5E6E1F739CB266E65B4C	6A435DF5CAC3D58CCAD655FE022CCF3DD4B9B721	16C3F6531D0FA5B4D16E82ABF066233B2A9F284C068C663699313C09F5E8D6E6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\enterpass[1].png	PNG image data, 170 x 29, 8-bit/color RGB, non-interlaced	BD6E291A9A3CC17ED37605E4FF0010CC	6C1EFD74231E3D253E0F51E4656ECED2F3335D71	706DE242E7C3CFC4B16BA8174723F26FB80566C3171E9E795F057476011A5DE1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\inv-big-background[1].png	PNG image data, 1920 x 1080, 8-bit colormap, non-interlaced	62DDD263C8A6A4C9074E205B91182D04	1B56D11B012DD79DD99212EBB54ADCFB60920A9D	A59EA699D353D00FF2999111F9FA11FB73A47EDA7800642609CA230560EA3703
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ellipsis_white[2].svg	SVG Scalable Vector Graphics image	5AC590EE72BFE06A7CECFD75B588AD73	DDA2CB89A241BC424746D8CF2A22A35535094611	6075736EA9C281D69C4A3D78FF97BB61B9416A5809919BABE5A0C5596F99AAEA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\firstmsg1[1].png	PNG image data, 353 x 41, 8-bit/color RGBA, non-interlaced	B7EA3983E3C2D7E5F61B8D1B42758189	FE0817947CA4BC53152ED9378470675D9AF189FD	7B6CF23AC2454B039DDF4F51B7074636ED5B08B6A1D254A47430C4ACE2A3569D
C:\Users\user\AppData\Local\Temp\~DF2C3DE4B398643922.TMP	data	195E7ED8F3F1A03AD4DAFE2ABC9A4F54	E7FCADD85CFBDE874C05F33834B09EF2F03F30A9	5F10C3F3FC1D9A82D47D16F23D34B93E28756C6107EDBB87492DEB57FE8EF25D
C:\Users\user\AppData\Local\Temp\~DF36A0BF1EB91DC84B.TMP	data	AEB984371C79D59FA69B86D41B3BC8A9	338758F38C994A40B342C9602605F74296E46F4F	E9AC9956FB430B1034AE66F34752ED08E68A5EFB2B310A5C5E038A03F6DF24CD
C:\Users\user\AppData\Local\Temp\~DF629A4FE2BF6AF1D3.TMP	data	9F8B958B45C7246769DF76A1C1D9E4C9	5116594EE94EAE2435D6CD7E75803AD37EEAAEF7	90D69BD3128AFA3B296B99EEBAB5822EE51AD935B5F63EE336D8CD376BFFBD6C

Analysis Report #U03bd#U03bf#U0456#U0441#U0435m#U0430#U0456l202114170492f#U0433#U03bfm+19796076561 19796076561.HTM

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs