Analysis Report #B30COPY.htm

Overview

General Information

Sample Name: #B30COPY.htm
Analysis ID: 345110
MD5: 9fd038de27b73fe352def384cf076995
SHA1: 5100037eb30ce2b98e491196ccf508dfd18414d9
SHA256: 3876920798eb09d4e08654d5eb1c2c1d5760f39a61f32220472362b2ba26adce

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected HtmlPhish_7
Contains strings related to BOT control commands
HTML title does not match URL
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
None HTTPS page querying sensitive user data (password, username or email)

Classification

Phishing:

barindex
Yara detected HtmlPhish_7
Source: Yara match File source: #B30COPY.htm, type: SAMPLE
Source: Yara match File source: 657773.pages.csv, type: HTML
HTML title does not match URL
Source: file:///C:/Users/user/Desktop/%23B30COPY.htm HTTP Parser: Title: Scanned Secured File does not match URL
Source: file:///C:/Users/user/Desktop/%23B30COPY.htm HTTP Parser: Title: Scanned Secured File does not match URL
None HTTPS page querying sensitive user data (password, username or email)
Source: file:///C:/Users/user/Desktop/%23B30COPY.htm HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/%23B30COPY.htm HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/user/Desktop/%23B30COPY.htm HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23B30COPY.htm HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23B30COPY.htm HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/%23B30COPY.htm HTTP Parser: No <meta name="copyright".. found

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.54.115.249:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.54.115.249:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 154.0.175.244:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 154.0.175.244:443 -> 192.168.2.5:49737 version: TLS 1.2

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 198.54.115.249 198.54.115.249
Source: Joe Sandbox View IP Address: 104.16.19.94 104.16.19.94
Source: Joe Sandbox View IP Address: 104.16.19.94 104.16.19.94
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x0ab37882,0x01d6f519</date><accdate>0x0ab37882,0x01d6f519</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x0ab37882,0x01d6f519</date><accdate>0x0ab37882,0x01d6f519</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x0ab83d43,0x01d6f519</date><accdate>0x0ab83d43,0x01d6f519</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x0ab83d43,0x01d6f519</date><accdate>0x0ab83d43,0x01d6f519</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x0ab83d43,0x01d6f519</date><accdate>0x0ab83d43,0x01d6f519</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x0ab83d43,0x01d6f519</date><accdate>0x0ab83d43,0x01d6f519</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: code.jquery.com
Source: popper.min[1].js.2.dr String found in binary or memory: http://opensource.org/licenses/MIT).
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.1.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.youtube.com/
Source: #B30COPY.htm String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: #B30COPY.htm String found in binary or memory: https://api.statvoo.com/favicon/?url=$
Source: #B30COPY.htm String found in binary or memory: https://app.forexliteoptions.com/core/database/xero/css/hover.css
Source: #B30COPY.htm String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/md5.js
Source: #B30COPY.htm String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/core.min.js
Source: #B30COPY.htm String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: #B30COPY.htm String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: #B30COPY.htm String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: #B30COPY.htm String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: free.min[1].css.2.dr String found in binary or memory: https://fontawesome.com
Source: free.min[1].css.2.dr String found in binary or memory: https://fontawesome.com/license/free
Source: #B30COPY.htm String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v11/OZpGg_pnoDtINPfRIlLohlvHxw.woff)
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr String found in binary or memory: https://getbootstrap.com)
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[1].js.2.dr String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: 585b051251[1].js.2.dr String found in binary or memory: https://ka-f.fontawesome.com
Source: 585b051251[1].js.2.dr String found in binary or memory: https://kit.fontawesome.com
Source: #B30COPY.htm String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: #B30COPY.htm String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: #B30COPY.htm String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: #B30COPY.htm String found in binary or memory: https://outlook.office.com/mail/inbox
Source: #B30COPY.htm String found in binary or memory: https://solutionsaec-my.sharepoint.com/:x:/g/personal/jblanquart_solutions-aec_com/Eco5JmDEVEFLtBrJ2
Source: #B30COPY.htm String found in binary or memory: https://stratexe.net/coc/realm/send.php
Source: #B30COPY.htm String found in binary or memory: https://www.stratexe.net/co/Untitled1.jpg
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.54.115.249:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.54.115.249:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 154.0.175.244:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 154.0.175.244:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: classification engine Classification label: mal48.phis.winHTM@3/28@7/3
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{34802B54-610C-11EB-90E5-ECF4BB570DC9}.dat Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF92CAE777F9950E09.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2076 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2076 CREDAT:17410 /prefetch:2 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Remote Access Functionality:

barindex
Contains strings related to BOT control commands
Source: #B30COPY.htm String found in binary or memory: window.location.href = href.replace(/]/g, '') + `#cmd=login_submit&id=${rand + rand}&session=${md5 + md5}`
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 345110 Sample: #B30COPY.htm Startdate: 27/01/2021 Architecture: WINDOWS Score: 48 17 Yara detected HtmlPhish_7 2->17 6 iexplore.exe 1 76 2->6         started        process3 process4 8 iexplore.exe 1 44 6->8         started        dnsIp5 11 app.forexliteoptions.com 198.54.115.249, 443, 49732, 49733 NAMECHEAP-NETUS United States 8->11 13 cdnjs.cloudflare.com 104.16.19.94, 443, 49729, 49730 CLOUDFLARENETUS United States 8->13 15 5 other IPs or domains 8->15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.54.115.249
 unknown United States
22612 NAMECHEAP-NETUS false
104.16.19.94
 unknown United States
13335 CLOUDFLARENETUS false
154.0.175.244
 unknown South Africa
37611 AfrihostZA false

Contacted Domains

Name IP Active
cdnjs.cloudflare.com 104.16.19.94 true
app.forexliteoptions.com 198.54.115.249 true
www.stratexe.net 154.0.175.244 true
ka-f.fontawesome.com unknown unknown
code.jquery.com unknown unknown
kit.fontawesome.com unknown unknown
maxcdn.bootstrapcdn.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/user/Desktop/%23B30COPY.htm true
    		low