Analysis Report https://beachhouseslbinj.com/secureemail.firstam.html

ID:	339308
Product:	CloudBasic
Start time:	20:45:09
Start date:	13.01.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6900F0FA-5623-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	AD533BAB823AE0F840C91571F6873131	DF77F38CA95DADB1BF4073F2EB551996B14AF694	D9DAF6619F049AD58E1ECA4A183C8ABD1FB4CB6648468B57181A3899D3E05BB9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6900F0FC-5623-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	C223CEA301021A5A65C7734CC7EFBAA8	000D55F5CED1F5633611902921F3D6ACEB7E8B82	04EF03F2211E881966C5D21CCF6CBC82C0494A77AA4F34481B4D111AA5BD4E53
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6F5EBE87-5623-11EB-90E5-ECF4BB570DC9}.dat	Microsoft Word Document	AA536AAA3F2FFE6B0A2E59A2FCDAB439	876E98A962E8DF27212107D8A1D6677D603456E1	B527796120BD040839765558C4D6DC3CE1C1C51246606EA94E02E40BD2BCFA8F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	65C8B0AB4BDBF8E6A34F4E54EBF2BC9B	63F16018BCF7902F49E82FCDF322E0B3741E370A	662F778E2D95B61803184F065DF37391884B96EF0C146E479FBACA5DD2B59DB6
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	7935F8FA293FA59437E257A0F39AFB7C	939962B622868020D9C057C3093C7C1C17456C56	8C111B919BF217504F1A54A6B57D0EC1DE27813F08842A50512A881028C3EAEF
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	94D50B3EA46FF056237B23CE3AE4F6FF	0DFA5D330E20C7BC97C3FE5A3781451B10CEC37F	8CC2F6B3D83C94C8D5636AB5260EF8DC6CB569F3A3D69577DB3A7E753AA17D66
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	05A8B1834114A6F4AAAB3A18A75D4821	A02ECA4DDE5A4987C19AB24F1E790E4CBD517E02	6450C6FA3CC2B6C9C5B12732BA0ABDCA8E3B568357BDAEDC3807D3AEE73A5738
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	D93A653116293004AD63A590C3EF6FC5	FABD8E09014181B6AEBC69611D1E3B20B6D14785	842DB4252D73CE45598D1FEC97517420D26FDFF4B2D07D0B0C7DB90C3595EC44
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	810E046019E53E460A9D86AF9E0B6148	BF5ABF60D610169223E306A6B85469DBA78E0BEE	07E87BDBD9C6FFDEACE9B2D5592BFA3CBBF4722C396B34370D6004FFAA51BD4D
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	1D9BD030B286AF1CD485FC70554C6384	35F856F5DA091AE9FA9893BBAE59D07AEF4C684F	B262A4A6A8D191D8E69F4446368522FEAA63C3C7555D8A566C36D404BA011A37
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	783B37F4998460CFE0D648662046CFD1	A4DA1A5118374A8F48D312A88FABB0F635D1E445	B1B9951564A7A3236DE82868ED45714EC73344A82E92B3CB6399A4FBFC3351F9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	3AF1A523C974F2B3BF638287145754D4	0068003B4A7402325A078294601FB9146EACEF55	48D314958DD6219F709DCCD0CDECEA4A291A0614633366B43A9FAA3FD7588AA1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\hotkey[1].jsf	ASCII text, with very long lines, with no line terminators	3EC16AA44D720657743FB21B8843A42A	63585295ACACCEFA397927146CDF66DD4E61B2D1	AA45349925767E946B92475663269F3388B684612CAF430E23E5080C60D617DF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\images[1].png	PNG image data, 225 x 225, 8-bit colormap, non-interlaced	ABB854F69762DD667761DB2263CF6FAF	2B162F4A224A1583819D1BCC3F2946F4F69F4149	C13AE3A103D8431DACFC0CD6A58C3E8970BA005E87B0799FE66D72217389A307
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\jsf[1].jsf	HTML document, ASCII text, with very long lines, with no line terminators	3E4F4050044D88C1DD0ED50742A7785D	188C5A4A665650BEFA953ACF5FEC87A8969BE5CA	E905FFB004E884DECC0118B5596596FE6FB88FEFDE62113402F3F8E1AC3BBA8A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\secureemail.firstam[1].htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	F2C78CFB811BBC1EC3A3B7B8CDB007CA	7D833680479CDA09D6CFCFF42D450A994BFCC021	E2C9DD2A7F7E5C9393A8E1A76C5DDAB25D18CB5A3B56130B5BB31B55C0570734
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\watermark[1].jsf	ASCII text, with very long lines, with no line terminators	E8F78B7AEB9DE00CFFBC206ED609D55C	F07A5BFBCAA94DC7A6DDAE96B0D01F7CF8365EFD	E5A6C207A3153F5650A788E557E1D67626F2F6035F602503B1D54D6A8151E95A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\components[1].jsf	ASCII text, with very long lines	A01877CDD1BA08596D5BE8C1BCF5BCAC	A8A0C8CD239D3472F9F252459EAA90475B80BFA1	9ED8FC97BC5F91C530D5605A290647FF860330D299EA326D0456AF0347D0794F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\core[1].jsf	ASCII text, with very long lines	AC2EA63393DC4ECD5A738AD19E605226	98ED11C667EC46FEB7E4DFAC070CD1FB8BED4DCB	62199D890704DFCC2E5DD56FE4517B0F406950E7FA6205A6421BB43CF3D2B1D3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\jquery-plugins[1].jsf	ASCII text, with very long lines	9C8F3B6B5F7E82093E42DF39B93024DC	2A20E6F9963047D6BF817267949DA7A4520E5B87	E88293D7FD0C6ADE3A72FC0C23A277AFDC2491CC5CAD653786C7D70DB54F510E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\jquery[1].jsf	ASCII text, with very long lines	A09E13EE94D51C524B7E2A728C7D4039	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\watermark[1].css	ASCII text, with no line terminators	4AA93D3E17F0FF0C58E3EA369B46F9F6	C3427F060374DF480D07A95253C77664BF3D30F6	CA84C793E087888C982358D7099D66BC23279D24B7EE3F4D3D984D9BF8DBA708
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\components[1].css	ASCII text, with very long lines	51AED875F4D1431BFF284BBD12EE085A	70C2CAB9B8E9778CA2C10CC59535A1A5AE17A5BB	FBCBA2E5F49EAE0C1C136FDADF9A6FD5F9617F4F359E433B0D0603A1B2198897
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\theme[1].css	ASCII text, with very long lines, with no line terminators	CDD9FA57966CDD025A224EFBBE25C3CB	C5A498AA760543A37129D14935E4A266956B6129	C81D165191FC4EE7381B985C36C84B4900CA83DC1F4745E37C447C6F695F4032
C:\Users\user\AppData\Local\Temp\~DF412E35109540FE9A.TMP	data	AB889A32AB9ACD33E816C2422337C69A	1190C6B34DED2D295827C2A88310D10A8B90B59B	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
C:\Users\user\AppData\Local\Temp\~DF780A56879F13B9BF.TMP	data	DF507E775050B9F7CB0E9DB1792A3E84	B03B2570C3B753EAD2298C89B4F958D19B495C56	F45B92A13FC5D3157EA2FB2C6174C9E43E835982A82F6FAB9EB82CE6AA52AE7D
C:\Users\user\AppData\Local\Temp\~DFD837063B69725408.TMP	data	25D75264538CBA20A83A74C65BEA733D	7F49889D868F119036FC35296A9C58DA8C1CD3EE	D8E7A25F9AE6C9D67F68538BD08D60DAF65CE8DEB4D317D671361B0C92F7898C

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://beachhouseslbinj.com/secureemail.firstam.html

Avira URL Cloud: detection malicious, Label: phishing

Multi AV Scanner detection for domain / URL

Source: https://beachhouseslbinj.com/secureemail.firstam.html

Virustotal: Detection: 9%

Perma Link

Multi AV Scanner detection for submitted file

Source: https://beachhouseslbinj.com/secureemail.firstam.html

Virustotal: Detection: 9%

Perma Link

Phishing:

Yara detected HtmlPhish_10

Source: Yara match

File source: 888683.pages.csv, type: HTML

Phishing site detected (based on logo template match)

Source: https://beachhouseslbinj.com/secureemail.firstam.html

Matcher: Template: office matched

HTML body contains low number of good links

Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: Number of links: 0
Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: Title: Encrypted Email Login does not match URL
Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: Title: Encrypted Email Login does not match URL

Suspicious form URL found

Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: Form action: securereader.php
Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: Form action: securereader.php

META author tag missing

Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: No <meta name="author".. found
Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: No <meta name="copyright".. found
Source: https://beachhouseslbinj.com/secureemail.firstam.html	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.214.94.29:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.214.94.29:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.214.94.29:443 -> 192.168.2.5:49729 version: TLS 1.2

Networking:

Found strings which match to known social media urls

Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x405407ca,0x01d6ea30</date><accdate>0x405407ca,0x01d6ea30</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x405407ca,0x01d6ea30</date><accdate>0x40566a2a,0x01d6ea30</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x405b2edd,0x01d6ea30</date><accdate>0x405b2edd,0x01d6ea30</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x405b2edd,0x01d6ea30</date><accdate>0x405b2edd,0x01d6ea30</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x405b2edd,0x01d6ea30</date><accdate>0x405b2edd,0x01d6ea30</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x405b2edd,0x01d6ea30</date><accdate>0x405b2edd,0x01d6ea30</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: beachhouseslbinj.com

Urls found in memory or binary data

Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: http://adomas.org/javascript-mouse-wheel/
Source: components[1].css.2.dr	String found in binary or memory: http://api.jqueryui.com/category/theming/
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: http://api.jqueryui.com/position/
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: http://brandonaaron.net)
Source: components[1].css.2.dr	String found in binary or memory: http://jquery.org/license
Source: components[1].css.2.dr, jquery-plugins[1].jsf.2.dr	String found in binary or memory: http://jqueryui.com
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: http://trentrichardson.com/examples/timepicker
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: http://www.jacklmoore.com/autosize
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: http://www.mathias-bank.de)
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: ~DF780A56879F13B9BF.TMP.1.dr	String found in binary or memory: https://beachhouseslbinj.com/secureemail.firstam.html
Source: {6900F0FC-5623-11EB-90E5-ECF4BB570DC9}.dat.1.dr	String found in binary or memory: https://beachhouseslbinj.com/secureemail.firstam.htmlRoot
Source: secureemail.firstam[1].htm.2.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTcugj8Hjl0fzSUDIJNZzTWpqUXD674DQ_muA&usqp=
Source: secureemail.firstam[1].htm.2.dr	String found in binary or memory: https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTcugj8Hjl0fzSUDIJNZzTWpqUXD674DQ_muA&usqp=CAU
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: https://github.com/furf/jquery-ui-touch-punch
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: https://github.com/gabceb
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: https://github.com/gabceb/jquery-browser-plugin
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: https://github.com/jquery/jquery-color
Source: jquery-plugins[1].jsf.2.dr	String found in binary or memory: https://github.com/markrian/jquery-ui-touch-punch-improved

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 162.214.94.29:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.214.94.29:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.214.94.29:443 -> 192.168.2.5:49729 version: TLS 1.2

System Summary:

Classification label

Source: classification engine

Classification label: mal76.phis.win@3/27@2/1

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6900F0FA-5623-11EB-90E5-ECF4BB570DC9}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFD837063B69725408.TMP

Jump to behavior

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:68 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:68 CREDAT:17410 /prefetch:2			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior